2! Authenticator Chrome extension security report

Do not wait for an insecure SMS authentication code to arrive on your phone! 2! Authenticator is a web browser extension that allows you to instantly see two-factor authentication codes (TOTP based) for login use on many major websites and apps. Hard at work on your desktop or laptop computer? Now your two-factor codes are just a click away in your browser! It is designed to be compatible with the other Authenticator © apps, and its use is similar. Easy to Use Add your two-factor codes by copying and pasting a QR Code image, drag-n-drop a QR code image, scanning a code with your webcam, or manually entering a two-factor key. Now your specific, time based, two-factor code for your online account is just a single click away. Private and Secure The extension is built with security and privacy in mind. Data is never shared with any other entities and a network connection is not required for the use of this extension, with the exception of registering for and the validating of paid features. Paid Features For a one time fee of USD $2.99 you may encrypt your data, lock your codes, transfer and get data backup for life. Encryption of Data (Paid Feature) There is the ability to encrypt and lock your data using the latest encryption standards (AES-GCM) with a pin or password. (DO NOT FORGET/LOSE YOUR PIN/PASSWORD! For security purposes, it is NOT possible to recover your data if your PIN/PASSWORD is lost.) Data Backup and Transfer (Paid Feature) Never lose your two-factor codes again! You may backup all of your two-factor codes in a secure format that may be restored at a later time. Backup your two-factor codes to a hard drive or cloud service of your choice. Additionally, you may choose to display an individual account’s QR code allowing each two-factor code to be transferred to another device. * Transferring codes from another authenticator app requires the use of a webcam. * Required Permissions The following permissions will be required to run this extension: * Read the active tab that is connected to https/secure websites (activeTab): Allows the extension to scan a QR code on a website that creates a QR code image to be consumed by an authenticator app. Webpages are only scanned by a user's action: The scan is computed locally and data is never sent over the internet during this process. * Camera: Allows the extension to use a webcam device to scan two-factor QR codes put in the webcam’s view. The camera is only activated by the user’s action. The scan is computed locally and data is never sent over the internet during this process. Disclaimer If you forget your password/PIN it is NOT recoverable! This is for your security and by design. * Transferring codes from another authenticator app requires the use of a webcam. * No software is ever perfect, nor free of bugs. Data loss and theft can occur. Use layered security and store you data in multiple locations. Password/PIN lengths affect security. Protect physical access to your device. Keep your device and software up-to-date. Known issues: * Transferring codes from other authenticator apps may be limited: Poor webcam resolution may reduce the number of accounts that may be transferred at one time. * Only 30 second epoch based TOTP based codes are supported for now. * Some style of QR codes are not supported. * Webpage scan is not always supported as many website actively guard against this feature. This extension makes no attempt to circumvent those guards. * Webcam use may be limited due to the low quality webcams used in many laptops. Version History 1.0.5 -- Fix pop-out window size to display full camera request permission. Fix useless parenthesis in account name. Fix inability to add a username to a TOTP code that was scanned or pasted in. Fix duplicate DB entry error on scanned/pasted TOTP codes. Advises the user to change the account name or username when attempting to make a duplicate entry. Update paid features API. 1.0.4 -- Fix possible Chrome Crash bug (again). Fix import of codes from other Authenticator apps. 1.0.3 -- Overcome Chrome crash bug, wait for user status to settle. 1.0.2 -- Only show FlyteSoft.org/2-factor website on very first install, not every update or Chrome update. 1.0.1 -- Initial public release.