5 ms·

Very fortunately, USB smartcards still work, work accross platforms, work without change since V1 of Chrome, and are really out of Chrome devs reach since they

Very fortunately, USB smartcards still work, work accross platforms, work without change since V1 of Chrome, and are really out of Chrome devs reach since they operate on the OS platform lib level in Windows.

vbezhenar 5y ago
Every device work by that definition. The question is about browser support without installing additional software. Here's my anecdote. In my country we use certificates to access government services. There are USB smartcards for secure storing and using those certificates. As there's no browser API to interact with smartcards, I'm forced to install their software. That software works only with installed root certificates (it uses https websocket on 127.0.0.1 to interact with browser). Few weeks ago they released new version and for some reason they decided to host it on a completely unrelated site owned by some private person. This is complete security madness, not even theater. So no, smartcards don't work. They're terrible from security perspective compared to native browser support, as they force user to install untrusted software with full access to the system and terrible security practices.
- fomine3 5y ago
  Smartcard access API should be made in a decade ago, rather than Web * (Bluetooth, MIDI, whatever) API. It's fundamental.
  - baybal2 5y ago
    Smartcard access api was present in all browsers decades ago, then purposefully aabotaged to make way for webauthn - which still doesn't work.
    - fomine3 5y ago
      Is it called Java Applet? It's overkill.
    - psanford 5y ago
      Webauthn works great.
- baybal2 5y ago
  > The question is about browser support without installing additional software. It's there. SSL library interfaces with pkcs11 without browser involvement, (and yes, browser makers sabotaged the PKCS 12 API to push webauthn — which is not even a direct replacement.) I repeat, it's not singing/encrypting with API, but providing authentication/client side encryption on the TLS layer, which works flawlessly.
fulafel 5y ago
What's the user experience like? Last time I saw the state of things, you had to run low level CLI tools at least on Ubuntu [1] [2]. It wasn't something that you could assume nontechnical end users can handle. [1] https://help.ubuntu.com/community/CommonAccessCard#Google_Chrome.2FChromium_Setup https://help.ubuntu.com/community/CommonAccessCard#Google_Ch... [2] https://unix.stackexchange.com/questions/302115/installing-smartcard-reader-in-chrome https://unix.stackexchange.com/questions/302115/installing-s...
- baybal2 5y ago
  It seems the removed systemwide p11 setup in Ubuntu, requiring few extra clicks. In Windows, it works without any hassle.
  - fulafel 5y ago
    I think the main thing with Chrome/Chromium was the browser's lack of a GUI for enabling the pkcs11 plugin your smartcard reader, necessitating the use of the modutil CLI. Firefox has this in the GUI (settings -> privacy and security -> security devices).

vbezhenar 5y ago

Every device work by that definition. The question is about browser support without installing additional software. Here's my anecdote. In my country we use certificates to access government services. There are USB smartcards for secure storing and using those certificates. As there's no browser API to interact with smartcards, I'm forced to install their software. That software works only with installed root certificates (it uses https websocket on 127.0.0.1 to interact with browser). Few weeks ago they released new version and for some reason they decided to host it on a completely unrelated site owned by some private person. This is complete security madness, not even theater. So no, smartcards don't work. They're terrible from security perspective compared to native browser support, as they force user to install untrusted software with full access to the system and terrible security practices.

fomine3 5y ago
Smartcard access API should be made in a decade ago, rather than Web * (Bluetooth, MIDI, whatever) API. It's fundamental.
- baybal2 5y ago
  Smartcard access api was present in all browsers decades ago, then purposefully aabotaged to make way for webauthn - which still doesn't work.
  - fomine3 5y ago
    Is it called Java Applet? It's overkill.
  - psanford 5y ago
    Webauthn works great.
baybal2 5y ago
> The question is about browser support without installing additional software. It's there. SSL library interfaces with pkcs11 without browser involvement, (and yes, browser makers sabotaged the PKCS 12 API to push webauthn — which is not even a direct replacement.) I repeat, it's not singing/encrypting with API, but providing authentication/client side encryption on the TLS layer, which works flawlessly.

fulafel 5y ago

What's the user experience like? Last time I saw the state of things, you had to run low level CLI tools at least on Ubuntu [1] [2]. It wasn't something that you could assume nontechnical end users can handle. [1] https://help.ubuntu.com/community/CommonAccessCard#Google_Chrome.2FChromium_Setup https://help.ubuntu.com/community/CommonAccessCard#Google_Ch... [2] https://unix.stackexchange.com/questions/302115/installing-smartcard-reader-in-chrome https://unix.stackexchange.com/questions/302115/installing-s...

baybal2 5y ago
It seems the removed systemwide p11 setup in Ubuntu, requiring few extra clicks. In Windows, it works without any hassle.
- fulafel 5y ago
  I think the main thing with Chrome/Chromium was the browser's lack of a GUI for enabling the pkcs11 plugin your smartcard reader, necessitating the use of the modutil CLI. Firefox has this in the GUI (settings -> privacy and security -> security devices).