Architectures to access Smart Card from a generic browser? Or: How to bridge the gap from browser to PC/SC stack?

by

The fact is that browsers can’t talk to (cryptographic) smart cards for other purposes than establishing SSL.

You shall need additional code, executed by the browser, to access smart cards.

There are tens of custom and proprietary plugins (using all three options you mentioned) for various purposes (signing being the most popular, I guess) built because there is no standard or universally accepted way, at least in Europe and I ‘m sure elsewhere as well.

Creating, distributing and maintaining your own shall be a blast, because browsers release every month or so and every new release changes sanboxing ir UI tricks, so you may need to adjust your code quite often.

And you probably would want to have GUI capabilities, at least for asking the permission of the user to access a card or some functionality on it.

For creating a multiple-platform, multiple browser plugin, something like firebreath could be used.

Personally, I don’t believe that exposing PC/SC to the web is any good. PC/SC is by nature qute a low level protocol that when exposing this, you could as well expose block level access to your disk and hope that “applications on the web are mine only and they behave well” (this should answer your “Also”). At the same time a thin shim like SConnect is the easiest to create, for providing a javscript plugin.sendAPDU()-style code (or just wrap all the PC/SC API and let the javascript caller take care of the same level of details as in native PC/SC API use case).

Creating a plugin for this purpose is usually driven by acute current deficiencies.

Addressing the future (mobile etc) is another story, where things like W3C webcrypto and OpenMobile API will probably finally somehow create something that exposes client-side key containers to web applications. If your target with smart cards is cryptography, my suggestion is to avoid PC/SC and use platform services (CryptoAPI on Windows, Keychain on OSX, PKCS#11 on Linux)

Any kind of design has requirements. This all applies if you’re thinking of using keys rather than arbitrary APDU-s. If your requirement is to send arbitrary APDU-s, do create a plugin and just go with it.

More Related Contents:

  1. Creating rounded corners using CSS [closed]
  2. Which graphic file formats are supported by browsers?
  3. Effective maximum mailto: body lengths
  4. How to bring back “Browser mode” in IE11?
  5. .SVG Browser Support
  6. 5 stars and the golden 5 stars are not together (When browsing with Internet explorer)
  7. Menu does not align correctly in Safari
  8. File input ‘accept’ attribute – is it useful?
  9. Browser detection versus feature detection
  10. How to build PDF file from binary string returned from a web-service using javascript
  11. OnChange event handler for radio button (INPUT type=”radio”) doesn’t work as one value
  12. Same font except its weight seems different on different browsers
  13. How to compress an image via Javascript in the browser?
  14. Truncating long strings with CSS: feasible yet?
  15. Style input type file? [duplicate]
  16. Show datalist labels but submit the actual value
  17. Jquery load() only working in firefox?
  18. What is WebKit and how is it related to CSS?
  19. Cross-browser bookmark/add to favorites JavaScript [duplicate]
  20. Should PUT and DELETE be used in forms?
  21. jQuery .attr(“disabled”, “disabled”) not working in Chrome
  22. Cross-browser testing: All major browsers on ONE machine
  23. Math.round(num) vs num.toFixed(0) and browser inconsistencies
  24. Cross-browser method for detecting the scrollTop of the browser window
  25. Why can’t I pass “window.location.reload” as an argument to setTimeout?
  26. Anchor tags not working in chrome when using #
  27. Javascript maximum size for types?
  28. How to perform Basic Authentication for FirefoxDriver, ChromeDriver and IEdriver in Selenium WebDriver?
  29. Find the exact height and width of the viewport in a cross-browser way
  30. How to display text in the browser status bar?

Leave a Comment