Logis Sign - Firma Electrónica Edge extension security report

Logis Sign Browser Extension: Secure Electronic PDF Signing with USB Tokens Logis Sign is a powerful browser extension crafted to seamlessly integrate secured electronic signatures into your web-based document workflows. Specifically designed for use on the LogisPort platform, this extension enables users to electronically sign PDF documents using cryptographic certificates stored on hardware USB tokens. By leveraging these secure tokens, Logis Sign ensures the highest level of signature authenticity, integrity, and legal compliance for your electronic documents. Upon installation, Logis Sign enhances your browser with zero-configuration signing capabilities that work in tandem with the LogisSign Native Host application installed on your computer. This design guarantees that all sensitive cryptographic operations, such as certificate retrieval, user authentication via PIN, and digital signing, occur locally on your machine and entirely within the secure boundaries of your USB token. This approach prevents private keys or sensitive data from ever leaving your device or being transmitted over the internet, ensuring strict adherence to security and regulatory requirements. The extension operates seamlessly with LogisPort’s services by automatically injecting a secure JavaScript API into supported websites. Through this API, websites can verify the extension and native host availability, access certificate details from the connected USB token, and trigger signature requests. The extension’s architecture is composed of three main elements: a background service worker that manages secure communication and message passing; content scripts that interface with the website environment; and injected scripts that expose an intuitive, reliable API to client-side web applications such as React-based portals. This layered design leverages the browser’s native messaging capabilities and permission controls to maintain airtight security while ensuring smooth interoperability. Logis Sign is ideally suited for professionals across various industries—lawyers authorizing contracts, HR personnel onboarding new employees, or enterprise users signing internal agreements—who require trustworthy and legally recognized electronic signatures integrated directly into their cloud or portal workflows. The extension keeps detailed logs of all signature operations, supporting audit trails and compliance verification, which is critical in regulated environments. Installation and use are straightforward: after adding the extension and installing the LogisSign Native Host on your computer, simply connect your USB token and access any compatible LogisPort webpage to start securely signing PDF documents. Throughout the signing process, user authentication such as PIN entry is handled locally, preserving confidentiality. Importantly, Logis Sign respects user privacy by not collecting any personal browsing or document data, with all communications confined strictly between trusted endpoints. Key Features: - Native PDF Signing Using USB Token: Securely performs cryptographic signing of PDF documents leveraging credentials stored directly on your hardware token, ensuring signature validity and denial of repudiation. - Seamless LogisPort Integration: Automatically activates on authorized LogisPort websites, injecting a secure, intuitive JavaScript API into your web workflow. - Exposed JavaScript API for Websites: Provides a transparent API (`window.LogisSign`) allowing web applications to check extension and native host status, access token certificate data, and initiate signing operations with ease. - End-to-End Secure Communications: Uses Chrome’s native messaging protocol for all interactions between the browser extension and the local native host application, guaranteeing private keys remain secure and offline. - Robust Logging and Audit Trail: Background service manages comprehensive logging of all signing events, facilitating compliance and troubleshooting needs. - User-Friendly Authentication Prompts: Handles USB token PIN entry and authentication locally, ensuring sensitive authentication data never traverses the network. - Zero Data Collection and Privacy by Design: No personal browsing or document information is tracked or stored; all operations are technical and secured locally. How It Works: 1. Install the Logis Sign extension from the Chrome Web Store and confirm that the LogisSign Native Host software is running on your computer. 2. Navigate to LogisPort or any supported portal such as https://logisport.com.ec where PDF signing is enabled. 3. The extension injects its secure JavaScript API into the webpage context, making signing functionalities accessible to web client applications. 4. When the website requests a PDF signature, it calls `window.LogisSign.signPdf()` with the PDF document in base64 format, the USB token PIN, and relevant metadata like reason, location, and contact information. 5. The extension routes this request securely to its background service worker, which confirms extension and native host availability. 6. The background service worker communicates with the locally installed Native Host executable (`LogisSignNativeHost.exe`), forwarding the signing command and authentication credentials. 7. The Native Host interacts directly with the connected USB token, retrieves certificate info, requests PIN authentication, and cryptographically signs the PDF document locally. 8. Upon successful completion, the signed PDF or status response is returned to the website via the exposed API, and the extension logs the operation for audit records. Privacy: - No personal data collected. All signature activities and user authentication processes occur exclusively on the user’s local device and USB token, ensuring maximum confidentiality and compliance.