Browser Extensions

[saswatasarkar13]

Browser Extensions Like

• Firefox
• Brave (Chromium)

[ua741]

After adding web access (https://auth.ente.io), this will be a low-priority item for us. If anyone in the community wants to create an extension, please feel free to reach out to us on Discord or Matrix.

The extension will only be valuable if it can auto-fill the codes, either automatically or with a minimum number of clicks.

[fr-gg]

In my opinion this isn't really needed, 2FA will be more secure if you only use it on mobile. Auth on the web is useful in case your phone breaks, and you need to have access to your accounts.

[DennisGaida]

Valid opinion. I would love an extension for convenience. There are password managers integrating 2FA left and right and we choose to not use these integrated solutions and go for another solution such as Ente Auth because of exactly that: security. Separating password manager and 2FA into two totally different apps makes it more secure.

Would a browser extension open up the attack surface to Ente Auth? Sure in some way. Ultimately it would be totally fine to just have the extension wrap the web site and and let me choose to fill 2FA codes automatically instead of me having to type stuff. So in terms of attack surface the browser extension is pretty much the same as opening the web site. There may be one attack vector like sites trying to steal your 2FA codes by mimicking other sites and the browser extension would make it easier to be duped by such sites - but in the end this is very similar to manually entering the 2FA codes on those sites.

Again: Valid opinion. I get where you are coming from. Personally I would love an extension for convenience - we're "only" talking TOTP codes here, not Password & TOTP. One is useless without the other.

[ashutoshsaboo]

I concur completely with the @DennisGaida 's thoughts above. An extension (all it has to majorly do is to be able to autofill 2fa codes) would definitely be helpful for user convenience.

[chakibchemso]

i agree with @DennisGaida too.

[Stupidboat]

There may be one attack vector like sites trying to steal your 2FA codes by mimicking other sites and the browser extension would make it easier to be duped by such sites - but in the end this is very similar to manually entering the 2FA codes on those sites.

i feel it could work in the opposite way, you could configure ur 2fa to only recognise a specific link so that in theory the extension could indicate if the site is a known 2fa website or not and either refuse or give a warning before allowing you to input ur code

[dudicoco]

In my opinion this isn't really needed, 2FA will be more secure if you only use it on mobile. Auth on the web is useful in case your phone breaks, and you need to have access to your accounts.

What about when you log into something from your mobile? Then it's no longer more secure as the 2FA is on the same device.

[nathfavour]

Is there anyone working on this already, or can I take it up?

[kitallis]

Happy to help with this @nathfavour, if this is something you're taking up. I'm used to using this.

P.S: I'm @kitallis on Discord.

[ashutoshsaboo]

Are either of you planning to build this extension? @nathfavour @kitallis I can help with testing if needed. Would find it super useful if a chrome extension can be built! I'm sure many others would also find it equally useful 🚀

[nathfavour]

LFG ;)

…

On Wed, Oct 2, 2024, 11:42 AM Akshay Gupta ***@***.***> wrote: Happy to help with this @nathfavour <https://github.com/nathfavour>, if this is something you're taking up. I'm used to using this <https://authenticator.cc>. P.S: I'm @kitallis <https://github.com/kitallis> on Discord. — Reply to this email directly, view it on GitHub <#1041 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A3ZDBOY4GVOFIMIZLGFXGI3ZZPEYJAVCNFSM6AAAAABESHT6K2VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTAOBRHEYDCNY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[nathfavour]

Yes, I am!

…

On Mon, Oct 28, 2024 at 6:19 PM Ashutosh Saboo ***@***.***> wrote: Are you planning to build this extension? @nathfavour <https://github.com/nathfavour> I can help with testing if needed. Would find it super useful if a chrome extension can be built! — Reply to this email directly, view it on GitHub <#1041 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A3ZDBO2R6P5GLEBMAYUDPCTZ5ZW3RAVCNFSM6AAAAABESHT6K2VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCMBXG43DSNY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[deltaxsingh]

How're things coming along? Do you need any testers?

[dnet890]

Browser extension also good. So, we can autofill our OTP or filled the OTP manually like Bitwarden or Proton pass

[nathfavour]

Yes, I agree. I've been thinking things through. I don't know if ente plans on building a password manager, but as it stands, a 2fa autofill extension would be an insufficient (or unnecessary) override on existing browser autofill defaults if it doesn't come with a password manager feature coupled. For example, I already use bitwarden by default, some people use chrome password manager. So, I might no longer be building this, unless there's a stronger use case/standpoint on utility/security.

…

On Sun, Feb 23, 2025 at 10:20 AM dudicoco ***@***.***> wrote: In my opinion this isn't really needed, 2FA will be more secure if you only use it on mobile. Auth on the web is useful in case your phone breaks, and you need to have access to your accounts. What about when you log into something from your mobile? Then it's no longer more secure as the 2FA is on the same device. — Reply to this email directly, view it on GitHub <#1041 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A3ZDBOZ4KYOJ533YZNBAWY32RGHG7AVCNFSM6AAAAABESHT6K2VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTEMRZGA2TIOI> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[deltaxsingh]

Which browser autofill defaults are you referring to for 2fa?

The utility is when the extension matches a URL to a specific site, the autofill would popup automatically. It is a separate function from password managers, especially bitwarden since it requires the premium version and does NOT automatically integrate with Ente (obviously). The added benefit being the separation between password manager and Ente, adding redundancy to an authentication system. Further, even if one were to have a premium password manager, you'll still have another third party 2fa authentication app to store your 2fa for said password manager.

Attached is an example of the benefit and utility of an extension that could plug into Ente.

[DennisGaida]

You are creating a lot of threads, you probably meant to reply to this thread here: #1041 (comment) - I suppose replying via E-Mail doesn't always work.

As to your point already discussed in that thread: Browser Autofill currently doesn't have TOTP tokens which Ente Auth is all about. Secondly you mentioned Bitwarden - Bitwarden WOULD have TOTP, but you would have both passwords and TOTP in one app.
I strongly believe that those users that do use Ente Auth are using it exactly because it is a separate TOTP-App and not integrated in any password app. If you use Bitwarden, LastPass, RoboForm or others you could use them to store TOTP tokens, but it kind of defeats the "second" factor if one of those apps were breached.
There are currently no plans I know of to make Ente Auth into a full fledged password manager.