1

I understand that browser's companies are not interested about the applications which use Smart Cards, applets, etc, anymore. So, I'd like to ask you guys about the approach that you will be taking from now and then without NPAPI.

In my company we are developing a new app which is basically digitally sign confidential documents and we are afraid of it and the nexts steps on this NPAPI novel. For now, just Chrome is removing this netscape plugin, but I know the other browsers are planning the same soon. Will we be back to desktop apps in order to sign documents digitally?

Thanks.

  • No personal experience with it, but I think that it might help: the `chrome.hid` app API: https://developer.chrome.com/apps/hid – Rob W May 16 '15 at 09:01

2 Answers2

1

FireBreath 2 will allow you to write a plugin that works in NPAPI, ActiveX, or through Native Messaging; it's getting close to ready to go into beta. It doesn't have any kind of real drawing support, but would work for what you describe. The install process is a bit of a pain, but it works.

The FireWyrm protocol that the native messaging component uses could be used with any connection that allows passing text data; it should be possible to make it work with js-ctypes on firefox or plausibly WEB-RTC or even CORS AJAX in some way. For now the only thing we needed to solve was Chrome, but we did it in a way that should be pretty portable to other technologies.

Check the #firebreath IRC channel on freenode if you want to help with the effort.

taxilian
  • 14,229
  • 4
  • 34
  • 73
  • Hey taxilian, thanks a lot for your answer. I'll be checking this solution and checking the irc channel as well! –  May 18 '15 at 12:11
  • https://www.firebreath.org/ fails to load with `The page isn’t redirecting properly`. Does not give much confidence... And just now I noticed that this post was from 2015... – Vincas Dargis May 28 '20 at 08:18
  • it's still used but I don't do much with it anymore. It's just not as necessary – taxilian May 28 '20 at 20:02
  • (and I'll get the web page back up one of these days, just feels like a lot of work for a project that not many use anymore =]) – taxilian May 28 '20 at 20:02
-1

I think in the future, you will be able to anything you can do in a desktop app in the browser. Chrome is able to remove NPAPI because most plugins can be replaced with HTML5/CSS3 and native browser APIs.

In terms of digital signatures, there are several implementations of capturing them using HTML5 canvas. One example is Signature pad.

Tatermelon
  • 489
  • 2
  • 10
  • Correct me if I'm wrong, but I don't know any javascript lib that can access content besides the sandbox, how will I communicate with a smart card hardware with the card/private key without an applet, for example? –  May 15 '15 at 00:43
  • ohh I think I misinterpreted what you meant by digital signature. I don't know of any existing APIs that can read Smart Cards directly from the browser, but I don't think it will be too long until one gets implemented. I think one reason why Chrome removed NPAPI support was to put pressure on browsers to create native browser APIs. – Tatermelon May 15 '15 at 00:54
  • See this related post http://stackoverflow.com/questions/6750928/smartcard-reader-access-from-a-web-browser – Tatermelon May 15 '15 at 00:54
  • Yep, thanks for the answer. Actually I read a lot about this subject and I know that we have Native Messaging api for Chrome, I was just wondering what about the other browsers...but yea, definitely this can be a movement to put some pressure on the industry. :) –  May 15 '15 at 01:14