Posting on the behalf of Vlastimil Ovčáčík:
Hello,
I would like to use Yubikey to encrypt/decrypt my saved passwords in Firefox 3.0 or higher. The passwords are protected by Master password. I know that Yubikey itself cannot provide the Master password, but Yubikey could authenticate me (me as possible Yubikey holder) on a server - and the server will provide the Master password...
Use case:
- a) there is a user who have yubikey, user has Firefox 3.0, Firefox has installed extension (client), on the internet is a server
b) user starts Firefox and he wants to use one of the encrypted password saved in Firefox
(note: to decrypt the password we need Master password, the Master password will be provided by server)
c) the extension will ask user to provide OTP (by using yubikey)
d) the extension will send OTP to server (HTTPS)
e) server contacts Yubico Authentication Server (sends OTP)
f) Yubico Authentication Server send to server user ID and confirmation of OTP, otherwise (bad OTP) the process ends
g) server according to user ID and confirmation of OTP will send appropriate Master password to the extension (Firefox) (HTTPS)
h) extension now can decrypt saved passwords in Firefox 3.0
The Firefox extension implementation:
- 1) The extension can be implemented as whole new Password manager (see this) or
2) just use API of standard Password manager.
Server implementation:
The server just have to securely store Master password and provide appropriate Master password to authenticated user.
- 1) Maybe an OpenID server with yubikey authentication or
2) Something like OpenSSO with yubikey authentication or
3) Whole new implementation for this special purpose.
As you see I am not expert
. I am looking forward for your comments. I would be very happy if we would find a secure way and at least thus flexible solution for storing passwords in Firefox. I believe that not only for me this would be killer app for Yubikey.Regards
Vlastimil Ovčáčík