Safari Extension

[nehalvpatel]

Something to look into. Safari has a lot of the same APIs that Chrome offers, they're just named or implemented differently.

https://developer.apple.com/library/content/documentation/UserExperience/Conceptual/SafariExtensionsConversionGuide/Chapters/Chrome.html

The options would be:

1. We can use if statements to use different APIs by detecting which browser the extension is running on. This is what I've done in my own projects.
2. Or we can make some sort of polyfill for the chrome.* object and implement Safari APIs that way.

Thoughts?

[kspearrin]

Supporting Safari would be great. If someone is familiar with the Safari API I would love to work with them to get this done. The polyfill sounds like the best option to me.

[MojoJojo]

Not sure if anyone is looking at FireFox/Safari/IE extensions.if not, then I'd love to take it up.

[kspearrin]

The extension is built using the chrome web extension api, which is supported already today by Chrome, Firefox, Opera, and Edge. So no work is needed there. The extensions are going through a review process already to be made available on these browsers. The only major browser that does not support web extension API is Safari, which is what this ticket is meant for. If you would like to help with adding Safari support, that'd be great.

[MojoJojo]

Thanks for the clarification. Would be happy to assist with the Safari Plugin.

[laingc]

Could anyone involved with this give a short update on progress on this issue?

[kspearrin]

@chrislaing There has not been any progress as far as I know due to other priorities.

[kspearrin]

@SpoonBytes Sorry, no news :(

[sysread]

I am quite interested in a plugin for Safari on desktop. Any chance of this getting dev attention?

[ghost]

I'm waiting for this too, meanwhile maybe this can be helpful: https://github.com/mozilla/webextension-polyfill

[Mattel88]

Any info when it will be released?

[eapen]

I took a look at this and there is quite a bit of work involved to do this - so I ended up making FF my primary browser. :-(

[MojoJojo]

Anyone willing to sponsor on Upwork or any other platform? I can tackle it sometime next week.

[sysread]

What scale of sponsorship are we talking about? Jeff Ober Old programmers don't die; they just parse on...

…

On Sep 13, 2017, at 4:41 AM, Sanket Sharma ***@***.***> wrote: Anyone willing to sponsor on Upwork or any other platform? I can tackle it sometime next week. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[kspearrin]

If people want to sponsor @MojoJojo working on a Safari port that is fine. We will be glad to review any work done, but please note that @MojoJojo is not affiliated with the bitwarden team in any way.

[sysread]

@kspearrin Thank you for the clarification. Any sponsorship (from me, anyway) would be predicated on the assumption of review by the bitwarden team as well as an OSS/public/commons/whatever license to ensure the possibility of community review and improvements (it is dealing with our most sensitive information, after all).

[Mattel88]

Would love to see it on Safari. I got all my bookmarks there and it synches best with iOS device which I only use.

[eapen]

I don't think desktop Safari extensions work on iOS devices. However, the existing bitwarden app for iOS works with Safari already.

[praveenperera]

I'll give +1 to this, I was about to switch from lastpass today but I mostly use safari.

[simplenotezy]

Would love to see Safari supported. Was actually surprised that it is not working with Safari already.

[czottmann]

Please add Safari support. I can't leave 90% of my organisation behind in terms of browser support.

[kolanos]

Was switching from LastPass, too. A Safari extension is a must have for me.

[Duartemartins]

Plis - use it very occasionally but it becomes a pain to use Safari without it.

[chessgriffin]

Please add support for a Safari extension. Thanks.

[d19dotca]

+1 for Safari support.

[nribault]

+1 too

[linuxtm]

+1 for Safari extension

[luxio]

+1

[MojoJojo]

HI,

I've created a bounty for this on boutysource: https://www.bountysource.com/issues/38267513-safari-extension
I will pick this up after the holidays in January and aiming to raise about 4K to cover my expenses for a month.
Look forward to your kind donations 🙏

[frickenate]

Having a third party developer throw together a Safari extension feels wrong. It might seem better than nothing, but keep in mind that bitwarden is in constant active development. New updates will be released in sync on every other platform, while Safari will be lagging behind until an external party gets around to pushing an equivalent update. Creating a Safari extension is not a one-time, one-month project. It will require constant attention, every couple of weeks.

Without trying to be a dick about it, some people are in fact paying a little money for bitwarden - probably too few of us, and perhaps paying too little? If a Safari extension is worth doing, it should be coming from the official source - in a way that is guaranteed to work identically to the other platforms. It's fantastic that bitwarden is open source, but considering the security implications of a password manager, it's necessary to caution users that opening their vault up to third-party applications poses additional risks. Even if bitwarden audits the initial release, they cannot possibly provide any guarantee that every update to that extension will be reviewed before it gets pushed to users.

Being open source, nobody can actually stop a third party developer from creating unofficial applications. And that's technically a great thing! The fact remains, however, that a password manager is an extremely serious product - to the point where trusting the official company is frankly terrifying enough. ;)

Edit: Suggestion: if the polyfill approach is viable, and the Safari-specific code is a very minimal wrapper of the official webextensions codebase, perhaps MojoJojo could do the initial port, at which point bitwarden would take over and officially maintain it. Of course, kspearrin cannot promise such a thing in advance - the extension would have to be finished before he could determine whether he'd be comfortable taking over.

[jacotec]

I've switched from Enpass to Bitwarden today as I love the ability to host it locally. Purchased the family subscription to support. Great project, but we're using Safari on our MacBooks ... so a big fat "+1" for the Safari extension.

From my opinion I support @frickenate - it should come from the Bitwarden team. There are too many projects with 3rd party plugins and/or extensions outside which stopped working at some point due to a mismatch of the core and the extensions.

[kspearrin]

Just an update here: We've been slowly refactoring parts of the codebase over the past several months to make Safari support more possible. It is on the TODO list for 2018.

[kspearrin]

I stared messing with this today and was actually able to get the extension interface loading in Safari where I could log in, browse my vault, add and edit items my vault, etc. There's much more to do but that's a significant step forward.

[kspearrin]

Good news everyone. It's ready! 🍾

Before we go live I would like to run a quick beta test here for those that are interested in helping test.

Download It

You can download the current Safari extension beta here: BETA IS OVER

When it has finished downloading just double click it and it should install.

Feedback

Please post and feedback or bug reports here in this thread so they can be addressed. We may follow up with an updated beta version to address any bugs. I will post here if/when that happens. The beta extension will not auto-update since it is not in the official Safari gallery yet.

Features Missing

A could of things worth noting about the Safari version vs. others (Chrome, Firefox, etc):

• There are no right-click context menu options for bitwarden.
• There is no keyboard shortcut available for generate password. Autofill (Command + \) and open popup (Command + Shift + Y) will work though.
• The toolbar icon is static. It does not change with the a lock icon, number of logins for the webpage you are on, etc.

These features are not available because Safari does not provide the APIs needed in order to implement them like other web browsers do.

Otherwise it should function pretty much the same as the other browsers.

---

Thanks for helping. Hopefully this will be officially released soon!

[shila77]

Saw this an hour ago. As far as I tested everything is working as expected.

Thank you very much. I think this is the thing a lot of user (including me) have waited for!

[d19dotca]

Is it true that there are no keyboard shortcuts because of a Safari limitation? I know that the 1Password Safari extension has a keyboard shortcut to activate the auto-fill, so was just curious if that was because 1Password also has an agent running on the desktop or if it was taking advantage of something in Safari which we just don't know yet?

[BooBerry]

The toolbar icon is static. It does not change with the a lock icon, number of logins for the webpage you are on, etc.

Huh, there has to be a way to do at least the number of logins, as I see Tampermonkey displaying a number when injecting userscripts on a website. Adblockers like uBlock Origin and AdGuard Adblocker display the numbers of ads blocked in the icon too, so this should be possible to display at least the number of logins.

As for further feedback, the bitwarden Safari extension lacks an icon under Safari's Preferences > Extensions section. Other extensions have icons associated with them, whereas the bitwarden extension doesn't (displays a generic Safari icon).

There are no right-click context menu options for bitwarden.

This should be possible too (not sure how limited it'd be though), as I see options for adblockers being added to the right-click context menu.

[kspearrin]

@BooBerry

1. There is a way to change the icon, but we havent figured out how it scales when doing so. For example, these are our two icons for lock/unlock:

They are the same size, yet when we change them they end up scaling differently and it looks odd....

2. We have fixed the icon you mentioned for next version.

3. Safari only allows you to add context menu options at the top level menu. They are not nestable like in other browsers.

[kspearrin]

@dustindauncey Likely coming from their desktop app communicating with the extension. Though there may be a way for us to inject a content script into the current website that will listen for shortcuts via Javascript and then communicate them back to the extension. Though this would only work while you are focused on that webpage which should always be the case when autofilling I guess.

[kspearrin]

As described above I was able to add a workaround to get limited support for keyboard shortcuts through an injected content script. Currently support will exist for:

• Autofill - This is currently set to Command + Shift + L (like the other browsers) but this seems to conflict with an existing safari shortcut to open the history sidebar. Suggestions on another mapping for this?
• Open popup - Command + Shift + Y

Not supported:

• The generate password shortcut cannot be supported since safari does not allow access to the clipboard without direct user interaction, which this does not classify as.

[kspearrin]

For autofill, it seems 1Password uses Command + \ so I have changed it to that for now.

[kspearrin]

All: Updated beta version is now available here: BETA IS OVER

Uninstall old version (beta1) before installing beta2.

Updates:

• Added extension icon
• Added keyboard shortcuts for autofill (Command + \) and open popup (Command + Shift + Y).
• Small bug fixes

Let me know how the new shortcuts are working for you.

[c10l]

Hi, I found a small issue with the latest beta.

I've imported a bunch of logins using the web vault but they wouldn't appear on the extension. After I restarted safari, they were there.

I waited about 5 minutes before quitting the browser.

[kspearrin]

@cassianoleal The extension wont instantly sync. This is the case with all browsers. It syncs automatically every 6 hours or you can manually sync from Settings -> Sync. A Sync will also happen when it is first opened.

[JanJastrow]

Meta-Question: Is there already a repo for the source of this safari extension?

[kspearrin]

@JanJastrow This is the repo.

[JanJastrow]

🤦‍♂️ – sorry, that was stupid of me. I didn't see that the beta of the safari extension was already in the repo.

[ghost]

I have Duo as a 2 step login verification and it won't get pass that(send a push or code text), it will just stay on "logging you in..."Any ideas why?

[yatesco]

Installed perfectly for me on macOS using Authy as the 2FA.

[kspearrin]

All: Updated beta version (beta3) is now available here: BETA IS OVER

Uninstall old version (beta1 or beta2) before installing beta3.

Updates:

• Added support for Duo 2FA. Flow for this is different than other browsers since Safari does not allow iframes in the popup. 😕
• Fixed issue where "open popup" shortcut would open the popup in a different window than the active one.
• Fix error on 2FA "pick another method" page.

@peterkeanu Can you please test the new Duo flow and let me know if you have any issues now?

[ghost]

The added support for Duo 2FA works now. Thanks for the update

[kspearrin]

The beta is now over. You can download the official release of bitwarden for safari from our website homepage. You should manually uninstall the beta version before doing so. Future updates should be automatic. We have also submitted the extension to the Safari Extension Gallery and are awaiting approval from Apple to be distributed there. We will post a blog post when that happens.

Thanks for the feedback all.

[xjrcode]

Here is the link to the Safari Extension Gallery:

https://safari-extensions.apple.com/details/?id=com.bitwarden.safari-LTZ2PFU5D6

[StoppingBuck]

I think an update to Safari has broken the extension discovery. The link by @Xavi-dev above just links to a special Extensions gallery in MacOS Mojave, and Bitwarden does not seem to be among the listed extensions :/

[xjrcode]

@StoppingBuck you need the Bitwarden mac app with the new Safari

[Alex0007]

Am I the only one who thinks that extension icon doesn't match style of other safari icons? 🤔