Lockrr Chrome Extension

A simple and straightforward lockrr Chrome Extension.

Requirements

Please install and run lockrr

Motivation

This extension is a litte faster to use the the cli lockrr. Eventually in the future we will have lockrr fully integrated.

The extension is built using React (boilerplate generated by create-react-app).

Privacy and other concerns

• requires the scripting and tabs permission to write the password to password fields. The tabs is to get the domain of the current tab.
• the extension only has network calls to the locally running lockrr. Only the generated password for the domain is sent, not the masterpassword.
• lockrr now requires a token to communicate between the chrome plugin over http. Starting the lockrr process will give you this token, and can always be regenerated
• the stored notes for the domain are returned decrypted to show the user
• any options stored for password generation settings for the domain are also returned

For the hashing algorithm, I used the official Javascript implementation of SuperGenPass installed as a npm module.

Behaviour and particularities

The extension keeps the default behaviour of SuperGenPass:

• subdomains are being stripped from the URL for which the password will be generated
• 10 hash rounds
• md5 as the hash function (other options might get included for the next versions of the extension)
• no salt is being added to the master password (this could be added in next versions of the extension)

These settings can be overriden by setting them in your lockrr for the domain.

Installation

Prerequisites:

• npm
• Chrome based web browser

Installation steps:

1. clone this repository
2. open a terminal, navigate to where you've cloned the repo and run npm i
3. run npm run build. This will create a build folder.
4. open any Chrome based browser, type chrome://extensions in the address bar
5. enable Developer mode by flicking the switch on the top-right corner
6. click on the Load unpacked button and select the aforementioned build folder

Power (a.k.a. lazy) users

If you're like me and you don't want to write your master password each time you want to generate a password for a website (please don't judge), I implemented a possible workflow for this scenario - you can inject a local environment variable into the build folder.

Just follow the steps described above, but instead of step 3, do the following:

• create a env.development file
• add a react_app_master_password variable into the file
  • example: REACT_APP_MASTER_PASSWORD=this_is_my_master_password
• run npm run build:development.
• continue with the next steps described above