NPAPI retirement and the future of digital signatu

Question

I understand that browser's companies are not interested about the applications which use Smart Cards, applets, etc, anymore. So, I'd like to ask you guys about the approach that you will be taking from now and then without NPAPI.

In my company we are developing a new app which is basically digitally sign confidential documents and we are afraid of it and the nexts steps on this NPAPI novel. For now, just Chrome is removing this netscape plugin, but I know the other browsers are planning the same soon. Will we be back to desktop apps in order to sign documents digitally?

Thanks.

Answer 1

FireBreath 2 will allow you to write a plugin that works in NPAPI, ActiveX, or through Native Messaging; it's getting close to ready to go into beta. It doesn't have any kind of real drawing support, but would work for what you describe. The install process is a bit of a pain, but it works.

The FireWyrm protocol that the native messaging component uses could be used with any connection that allows passing text data; it should be possible to make it work with js-ctypes on firefox or plausibly WEB-RTC or even CORS AJAX in some way. For now the only thing we needed to solve was Chrome, but we did it in a way that should be pretty portable to other technologies.

Check the #firebreath IRC channel on freenode if you want to help with the effort.

Answer 2

I think in the future, you will be able to anything you can do in a desktop app in the browser. Chrome is able to remove NPAPI because most plugins can be replaced with HTML5/CSS3 and native browser APIs.

In terms of digital signatures, there are several implementations of capturing them using HTML5 canvas. One example is Signature pad.