U2F不支持U2F Chrome扩展 [英] U2F support without the U2F Chrome extension

问题描述

我开始摆弄U2F，看起来很有前景。得到了一些安全密钥，并开始挖掘它。
我已经成功创建了一个工作注册/登录演示网站，它使用U2F令牌和U2F Chrome扩展程序可以很好地工作。

然而......和这就是我的问题出现的地方：
我还为我的Google帐号注册了一个安全密钥，并立即感到震惊，因为它不使用U2F Chrome扩展。事实上，我已经完成了所有Google注册和登录，甚至没有安装扩展程序。这怎么可能？我已阅读（部分）FIDO规范，并看到可能存在两个API级别：高级（这是扩展所公开的u2f名称空间）和 - 低级（涉及使用MessagePort API）。也许这就是Google如何做到的？ （也尝试自己做一个chrome.runtime.connect（...），但chrome.runtime对象在我的网页中是未定义的）

正确的任何指针方向将不胜感激，并在此刻有很大的价值，因为这个年轻的项目名为U2F没有太多可用的资源。 解决方案

Chrome是白名单，谷歌域名。现在非Google网域必须使用扩展程序。不过，根据谷歌的说法，这将很快发生变化 - 这是记录在案的 ，并由Google开发人员在本次网络研讨会上提及。

修改： Chrome 41不再需要该扩展程序。您可以对其进行测试 here （注意：当从旧版本的Chrome访问，或不通过HTTPS时，该网站将回退到使用扩展名）。

I've started fiddling around with U2F and it's looking really promising. Got myself some security keys and started digging into it. I've managed to create a working register/login demo website which works well using the U2F tokens and the U2F Chrome extension.

However... and this is where my question arises: I've also enrolled a security key for my Google account and immediately got struck by the fact that it works without using the U2F Chrome extension. As a matter of fact I've done all the Google enrollment and logins without even having the extension installed. How is this possible? I've read (some of) the FIDO specifications and saw that there may be two API levels: high - which is the u2f namespace exposed by the extension and - and low - which involves using MessagePort API. Maybe this is how Google does it? (also tried doing a chrome.runtime.connect(...) myself, but the chrome.runtime object is undefined in my web page)

Any pointer in the proper direction would be appreciated and of great value at this moment, as there aren't many resources available on this young project called U2F.

解决方案

Chrome is white listing Google domains. Non-Google domains has to use the extension for now. However, this will change "very soon" according to Google -- this is documented here and mentioned by a Google developer in this webinar.

Edit: The extension is no longer required with Chrome 41. You can test it out here (Note: When accessed from and older version of Chrome, or not via HTTPS, the site will fall back to using the extension).

这篇关于U2F不支持U2F Chrome扩展的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！