Merge branch 'master' into feature/fit-finish

src/app/accounts/settings.component.html

@@ -88,6 +88,16 @@
                             </div>
                             <small class="help-block">{{'disableFaviconDesc' | i18n}}</small>
                         </div>
+                        <div class="form-group">
+                            <div class="checkbox">
+                                <label for="enableBrowserIntegration">
+                                    <input id="enableBrowserIntegration" type="checkbox" name="EnableBrowserIntegration"
+                                        [(ngModel)]="enableBrowserIntegration" (change)="saveBrowserIntegration()">
+                                    {{'enableBrowserIntegration' | i18n}}
+                                </label>
+                            </div>
+                            <small class="help-block">{{'enableBrowserIntegrationDesc' | i18n}}</small>
+                        </div>
                         <div class="form-group">
                             <div class="checkbox">
                                 <label for="enableTray">

src/app/accounts/settings.component.ts

@@ -33,6 +33,7 @@ export class SettingsComponent implements OnInit {
     vaultTimeoutAction: string;
     pin: boolean = null;
     disableFavicons: boolean = false;
+    enableBrowserIntegration: boolean = false;
     enableMinToTray: boolean = false;
     enableCloseToTray: boolean = false;
     enableTray: boolean = false;
@@ -143,6 +144,7 @@ export class SettingsComponent implements OnInit {
         const pinSet = await this.vaultTimeoutService.isPinLockSet();
         this.pin = pinSet[0] || pinSet[1];
         this.disableFavicons = await this.storageService.get<boolean>(ConstantsService.disableFaviconKey);
+        this.enableBrowserIntegration = await this.storageService.get<boolean>(ElectronConstants.enableBrowserIntegration);
         this.enableMinToTray = await this.storageService.get<boolean>(ElectronConstants.enableMinimizeToTrayKey);
         this.enableCloseToTray = await this.storageService.get<boolean>(ElectronConstants.enableCloseToTrayKey);
         this.enableTray = await this.storageService.get<boolean>(ElectronConstants.enableTrayKey);
@@ -313,6 +315,11 @@ export class SettingsComponent implements OnInit {
         this.messagingService.send(this.openAtLogin ? 'addOpenAtLogin' : 'removeOpenAtLogin');
     }
 
+    async saveBrowserIntegration() {
+        await this.storageService.save(ElectronConstants.enableBrowserIntegration, this.enableBrowserIntegration);
+        this.messagingService.send(this.enableBrowserIntegration ? 'enableBrowserIntegration' : 'disableBrowserIntegration');
+    }
+
     private callAnalytics(name: string, enabled: boolean) {
         const status = enabled ? 'Enabled' : 'Disabled';
         this.analytics.eventTrack.next({ action: `${status} ${name}` });

src/app/app.component.ts

@@ -52,6 +52,7 @@ import { UserService } from 'jslib/abstractions/user.service';
 import { VaultTimeoutService } from 'jslib/abstractions/vaultTimeout.service';
 
 import { ConstantsService } from 'jslib/services/constants.service';
+import { NativeMessagingService } from '../services/nativeMessaging.service';
 
 const BroadcasterSubscriptionId = 'AppComponent';
 const IdleTimeout = 60000 * 10; // 10 minutes
@@ -97,7 +98,7 @@ export class AppComponent implements OnInit {
         private searchService: SearchService, private notificationsService: NotificationsService,
         private platformUtilsService: PlatformUtilsService, private systemService: SystemService,
         private stateService: StateService, private eventService: EventService,
-        private policyService: PolicyService) { }
+        private policyService: PolicyService, private nativeMessagingService: NativeMessagingService) { }
 
     ngOnInit() {
         this.ngZone.runOutsideAngular(() => {

src/app/services.module.ts

@@ -18,6 +18,7 @@ import { isDev } from 'jslib/electron/utils';
 import { DeviceType } from 'jslib/enums/deviceType';
 
 import { I18nService } from '../services/i18n.service';
+import { NativeMessagingService } from '../services/nativeMessaging.service';
 
 import { AuthGuardService } from 'jslib/angular/services/auth-guard.service';
 import { BroadcasterService } from 'jslib/angular/services/broadcaster.service';
@@ -132,6 +133,8 @@ const environmentService = new EnvironmentService(apiService, storageService, no
 const eventService = new EventService(storageService, apiService, userService, cipherService);
 const systemService = new SystemService(storageService, vaultTimeoutService, messagingService, platformUtilsService,
     null);
+const nativeMessagingService = new NativeMessagingService(cryptoFunctionService, cryptoService, platformUtilsService,
+    logService, i18nService, userService, messagingService);
 
 const analytics = new Analytics(window, () => isDev(), platformUtilsService, storageService, appIdService);
 containerService.attachToGlobal(window);
@@ -216,6 +219,7 @@ export function initFactory(): Function {
         { provide: PolicyServiceAbstraction, useValue: policyService },
         { provide: SendServiceAbstraction, useValue: sendService },
         { provide: CryptoFunctionServiceAbstraction, useValue: cryptoFunctionService },
+        { provide: NativeMessagingService, useValue: nativeMessagingService },
         {
             provide: APP_INITIALIZER,
             useFactory: initFactory,

src/global.d.ts

@@ -1,2 +1,6 @@
 declare function escape(s: string): string;
 declare function unescape(s: string): string;
+declare module 'node-ipc' {
+    const x: any;
+    export = x;
+}

src/locales/en/messages.json

@@ -1437,5 +1437,20 @@
   },
   "acceptPoliciesError": {
     "message": "Terms of Service and Privacy Policy have not been acknowledged."
+  },
+  "enableBrowserIntegration": {
+    "message": "Enable browser integration"
+  },
+  "enableBrowserIntegrationDesc": {
+    "message": "Browser integration is used for biometrics in browser."
+  },
+  "approve": {
+    "message": "Approve"
+  },
+  "verifyBrowserTitle": {
+    "message": "Verify browser connection"
+  },
+  "verifyBrowserDescription": {
+    "message": "Please ensure the shown fingerprint is identical to the fingerprint showed in the browser extension."
   }
 }

src/main.ts

@@ -18,6 +18,8 @@ import { ElectronStorageService } from 'jslib/electron/services/electronStorage.
 import { TrayMain } from 'jslib/electron/tray.main';
 import { UpdaterMain } from 'jslib/electron/updater.main';
 import { WindowMain } from 'jslib/electron/window.main';
+import { NativeMessagingMain } from './main/nativeMessaging.main';
+import { NativeMessagingProxy } from './proxy/native-messaging-proxy';
 
 export class Main {
     logService: ElectronLogService;
@@ -33,6 +35,7 @@ export class Main {
     powerMonitorMain: PowerMonitorMain;
     trayMain: TrayMain;
     biometricMain: BiometricMain;
+    nativeMessagingMain: NativeMessagingMain;
 
     constructor() {
         // Set paths for portable builds
@@ -116,6 +119,8 @@ export class Main {
             const BiometricDarwinMain = require('jslib/electron/biometric.darwin.main').default;
             this.biometricMain = new BiometricDarwinMain(this.storageService, this.i18nService);
         }
+
+        this.nativeMessagingMain = new NativeMessagingMain(this.logService, this.windowMain, app.getPath('userData'), app.getAppPath());
     }
 
     bootstrap() {
@@ -140,6 +145,10 @@ export class Main {
                 await this.biometricMain.init();
             }
 
+            if (await this.storageService.get<boolean>(ElectronConstants.enableBrowserIntegration)) {
+                this.nativeMessagingMain.listen();
+            }
+
             if (!app.isDefaultProtocolClient('bitwarden')) {
                 app.setAsDefaultProtocolClient('bitwarden');
             }
@@ -175,5 +184,22 @@ export class Main {
     }
 }
 
-const main = new Main();
-main.bootstrap();
+if (process.argv.some(arg => arg.indexOf('chrome-extension://') !== -1 || arg.indexOf('{') !== -1)) {
+    if (process.platform === 'darwin') {
+        app.on('ready', () => {
+            app.dock.hide();
+        });
+    }
+
+    process.stdout.on('error', (e) => {
+        if (e.code === 'EPIPE') {
+            process.exit(0);
+        }
+    });
+
+    const proxy = new NativeMessagingProxy();
+    proxy.run();
+} else {
+    const main = new Main();
+    main.bootstrap();
+}

src/main/messaging.main.ts

@@ -38,7 +38,7 @@ export class MessagingMain {
             case 'minimizeOnCopy':
                 this.storageService.get<boolean>(ElectronConstants.minimizeOnCopyToClipboardKey).then(
                     (shouldMinimize) => {
-                        if (shouldMinimize && this.main.windowMain.win != null) {
+                        if (shouldMinimize && this.main.windowMain.win !== null) {
                             this.main.windowMain.win.minimize();
                         }
                     });
@@ -57,6 +57,16 @@ export class MessagingMain {
                 break;
             case 'removeOpenAtLogin':
                 this.removeOpenAtLogin();
+            case 'setFocus':
+                this.setFocus();
+                break;
+            case 'enableBrowserIntegration':
+                this.main.nativeMessagingMain.generateManifests();
+                this.main.nativeMessagingMain.listen();
+                break;
+            case 'disableBrowserIntegration':
+                this.main.nativeMessagingMain.removeManifests();
+                this.main.nativeMessagingMain.stop();
                 break;
             default:
                 break;
@@ -123,4 +133,9 @@ export class MessagingMain {
     private linuxStartupFile(): string {
         return path.join(app.getPath('home'), '.config', 'autostart', 'bitwarden.desktop');
     }
+
+    private setFocus() {
+        this.main.trayMain.restoreFromTray();
+        this.main.windowMain.win.focusOnWebView();
+    }
 }

src/main/nativeMessaging.main.ts

@@ -0,0 +1,203 @@
+import { promises as fs, existsSync } from 'fs';
+import * as ipc from 'node-ipc';
+import * as path from 'path';
+import * as util from 'util';
+import { homedir } from 'os';
+
+import { LogService } from 'jslib/abstractions/log.service';
+import { ipcMain } from 'electron';
+import { WindowMain } from 'jslib/electron/window.main';
+
+export class NativeMessagingMain {
+    private connected = false;
+
+    constructor(private logService: LogService, private windowMain: WindowMain, private userPath: string, private appPath: string) {}
+
+    listen() {
+        ipc.config.id = 'bitwarden';
+        ipc.config.retry = 1500;
+
+        ipc.serve(() => {
+            ipc.server.on('message', (data: any, socket: any) => {
+                // This is a ugly hack until electron is updated 7.0.0 which supports ipcMain.invoke
+                this.windowMain.win.webContents.send('nativeMessaging', data);
+                ipcMain.once('nativeMessagingReply', (event, msg) => {
+                    if (msg != null) {
+                        this.send(msg, socket);
+                    }
+                });
+            });
+
+            ipc.server.on('connect', () => {
+                this.connected = true;
+            })
+
+            ipc.server.on(
+                'socket.disconnected',
+                (socket: any, destroyedSocketID: any) => {
+                    this.connected = false;
+                    ipc.log(
+                        'client ' + destroyedSocketID + ' has disconnected!'
+                    );
+                }
+            );
+        });
+
+        ipc.server.start();
+    }
+
+    stop() {
+        ipc.server.stop();
+    }
+
+    send(message: object, socket: any) {
+        ipc.server.emit(socket, 'message', message);
+    }
+
+    generateManifests() {
+        const baseJson = {
+            'name': 'com.8bit.bitwarden',
+            'description': 'Bitwarden desktop <-> browser bridge',
+            'path': this.binaryPath(),
+            'type': 'stdio',
+        }
+
+        const firefoxJson = {...baseJson, ...{ 'allowed_extensions': ['{446900e4-71c2-419f-a6a7-df9c091e268b}']}};
+        const chromeJson = {...baseJson, ...{
+            'allowed_origins': [
+                'chrome-extension://nngceckbapebfimnlniiiahkandclblb/',
+                'chrome-extension://jbkfoedolllekgbhcbcoahefnbanhhlh/',
+                'chrome-extension://ccnckbpmaceehanjmeomladnmlffdjgn/'
+            ]
+        }};
+
+        switch (process.platform) {
+            case 'win32':
+                const destination = path.join(this.userPath, 'browsers');
+                this.writeManifest(path.join(destination, 'firefox.json'), firefoxJson);
+                this.writeManifest(path.join(destination, 'chrome.json'), chromeJson);
+
+                this.createWindowsRegistry('HKLM\\SOFTWARE\\Mozilla\\Firefox', 'HKCU\\SOFTWARE\\Mozilla\\NativeMessagingHosts\\com.8bit.bitwarden', path.join(destination, 'firefox.json'))
+                this.createWindowsRegistry('HKCU\\SOFTWARE\\Google\\Chrome', 'HKCU\\SOFTWARE\\Google\\Chrome\\NativeMessagingHosts\\com.8bit.bitwarden', path.join(destination, 'chrome.json'))
+                break;
+            case 'darwin':
+                if (existsSync(`${homedir()}/Library/Application\ Support/Mozilla/`)) {
+                    this.writeManifest(`${homedir()}/Library/Application\ Support/Mozilla/NativeMessagingHosts/com.8bit.bitwarden.json`, firefoxJson)
+                }
+
+                if (existsSync(`${homedir()}/Library/Application\ Support/Google/Chrome`)) {
+                    this.writeManifest(`${homedir()}/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.8bit.bitwarden.json`, chromeJson)
+                }
+                break;
+            case 'linux':
+                if (existsSync(`${homedir()}/.mozilla/`)) {
+                    this.writeManifest(`${homedir()}/.mozilla/native-messaging-hosts/com.8bit.bitwarden.json`, firefoxJson)
+                }
+
+                if (existsSync(`${homedir()}/.config/google-chrome/`)) {
+                    this.writeManifest(`${homedir()}/.config/google-chrome/NativeMessagingHosts/com.8bit.bitwarden.json`, chromeJson)
+                }
+                break;
+            default:
+                break;
+        }
+    }
+
+    removeManifests() {
+        switch (process.platform) {
+            case 'win32':
+                fs.unlink(path.join(this.userPath, 'browsers', 'firefox.json'));
+                fs.unlink(path.join(this.userPath, 'browsers', 'chrome.json'));
+                this.deleteWindowsRegistry('HKCU\\SOFTWARE\\Mozilla\\NativeMessagingHosts\\com.8bit.bitwarden');
+                this.deleteWindowsRegistry('HKCU\\SOFTWARE\\Google\\Chrome\\NativeMessagingHosts\\com.8bit.bitwarden');
+                break;
+            case 'darwin':
+                if (existsSync('~/Library/Application Support/Mozilla/NativeMessagingHosts/com.8bit.bitwarden.json')) {
+                    fs.unlink('~/Library/Application Support/Mozilla/NativeMessagingHosts/com.8bit.bitwarden.json');
+                }
+
+                if (existsSync('~/Library/Application Support/Google/Chrome/NativeMessagingHosts/com.8bit.bitwarden.json')) {
+                    fs.unlink('~/Library/Application Support/Mozilla/NativeMessagingHosts/com.8bit.bitwarden.json');
+                }
+                break;
+            case 'linux':
+                if (existsSync('~/.mozilla/native-messaging-hosts/com.8bit.bitwarden.json')) {
+                    fs.unlink('~/.mozilla/native-messaging-hosts/com.8bit.bitwarden.json');
+                }
+
+                if (existsSync('~/.config/google-chrome/NativeMessagingHosts/com.8bit.bitwarden.json')) {
+                    fs.unlink('~/.config/google-chrome/NativeMessagingHosts/com.8bit.bitwarden.json');
+                }
+                break;
+            default:
+                break;
+        }
+    }
+
+    private writeManifest(destination: string, manifest: object) {
+        fs.mkdir(path.dirname(destination));
+        fs.writeFile(destination, JSON.stringify(manifest, null, 2)).catch(this.logService.error);
+    }
+
+    private binaryPath() {
+        const dir = path.join(this.appPath, '..');
+        if (process.platform === 'win32') {
+            return path.join(dir, 'native-messaging.bat');
+        } else if (process.platform === 'darwin') {
+            return path.join(dir, '..', 'MacOS', 'Bitwarden');
+        }
+
+        return path.join(dir, '..', 'bitwarden');
+    }
+
+    private async createWindowsRegistry(check: string, location: string, jsonFile: string) {
+        const regedit = require('regedit');
+        regedit.setExternalVBSLocation('resources/regedit/vbs');
+
+        const list = util.promisify(regedit.list);
+        const createKey = util.promisify(regedit.createKey);
+        const putValue = util.promisify(regedit.putValue);
+
+        this.logService.debug(`Adding registry: ${location}`)
+
+        // Check installed
+        try {
+            await list(check)
+        } catch {
+            return;
+        }
+
+        try {
+            await createKey(location);
+
+            // Insert path to manifest
+            const obj: any = {};
+            obj[location] = {
+                'default': {
+                    value: jsonFile,
+                    type: 'REG_DEFAULT',
+                },
+            }
+
+            return putValue(obj);
+        } catch (error) {
+            this.logService.error(error);
+        }
+    }
+
+    private async deleteWindowsRegistry(key: string) {
+        const regedit = require('regedit');
+
+        const list = util.promisify(regedit.list);
+        const deleteKey = util.promisify(regedit.deleteKey);
+
+        this.logService.debug(`Removing registry: ${key}`)
+
+        try {
+            await list(key);
+            await deleteKey(key);
+        } catch {
+            // Do nothing
+        }
+    }
+}

src/package.json

@@ -2,7 +2,7 @@
   "name": "bitwarden",
   "productName": "Bitwarden",
   "description": "A secure and free password manager for all of your devices.",
-  "version": "1.23.0",
+  "version": "1.23.1",
   "author": "Bitwarden Inc. <hello@bitwarden.com> (https://bitwarden.com)",
   "homepage": "https://bitwarden.com",
   "license": "GPL-3.0",
@@ -19,6 +19,7 @@
     "electron-store": "1.3.0",
     "electron-updater": "4.3.5",
     "keytar": "4.13.0",
+    "node-ipc": "^9.1.1",
     "zxcvbn": "4.4.2"
   }
 }

src/proxy/ipc.ts

@@ -0,0 +1,51 @@
+/* tslint:disable:no-console */
+import * as ipc from 'node-ipc';
+
+ipc.config.id = 'proxy';
+ipc.config.retry = 1500;
+ipc.config.logger = console.warn; // Stdout is used for native messaging
+
+export default class IPC {
+    onMessage: (message: object) => void
+
+    private connected = false;
+
+    connect() {
+        ipc.connectTo('bitwarden', () => {
+            ipc.of.bitwarden.on('connect', () => {
+                this.connected = true;
+                console.error(
+                    '## connected to bitwarden desktop ##',
+                    ipc.config.delay
+                );
+
+                // Notify browser extension, connection is established to desktop application.
+                this.onMessage({command: 'connected'})
+            });
+
+            ipc.of.bitwarden.on('disconnect', () => {
+                this.connected = false;
+                console.error('disconnected from world');
+
+                // Notify browser extension, no connection to desktop application.
+                this.onMessage({command: 'disconnected'})
+            });
+
+            ipc.of.bitwarden.on('message', (message: any) => {
+                this.onMessage(message);
+            });
+
+            ipc.of.bitwarden.on('error', (err: any) => {
+                console.error('error', err);
+            });
+        });
+    }
+
+    isConnected(): boolean {
+        return this.connected;
+    }
+
+    send(json: object) {
+        ipc.of.bitwarden.emit('message', json);
+    }
+}

src/proxy/native-messaging-proxy.ts

@@ -0,0 +1,23 @@
+import NativeMessage from './nativemessage';
+import IPC from './ipc';
+
+// Proxy is a lightweight application which provides bi-directional communication
+// between the browser extension and a running desktop application.
+//
+// Browser extension <-[native messaging]-> proxy <-[ipc]-> desktop
+export class NativeMessagingProxy {
+    private ipc: IPC;
+    private nativeMessage: NativeMessage;
+
+    constructor() {
+        this.ipc = new IPC();
+        this.nativeMessage = new NativeMessage(this.ipc);
+    }
+
+    run() {
+        this.ipc.connect();
+        this.nativeMessage.listen();
+
+        this.ipc.onMessage = this.nativeMessage.send;
+    }
+}

src/proxy/nativemessage.ts

@@ -0,0 +1,89 @@
+/* tslint:disable:no-console */
+import IPC from './ipc';
+
+// Mostly based on the example from MDN,
+// https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Native_messaging
+export default class NativeMessage {
+    ipc: IPC;
+
+    constructor(ipc: IPC) {
+        this.ipc = ipc;
+    }
+
+    send(message: object) {
+        const messageBuffer = Buffer.from(JSON.stringify(message));
+
+        const headerBuffer = Buffer.alloc(4);
+        headerBuffer.writeUInt32LE(messageBuffer.length, 0);
+
+        process.stdout.write(Buffer.concat([headerBuffer, messageBuffer]));
+    }
+
+    listen() {
+        let payloadSize: number = null;
+
+        // A queue to store the chunks as we read them from stdin.
+        // This queue can be flushed when `payloadSize` data has been read
+        const chunks: any = [];
+
+        // Only read the size once for each payload
+        const sizeHasBeenRead = () => Boolean(payloadSize);
+
+        // All the data has been read, reset everything for the next message
+        const flushChunksQueue = () => {
+            payloadSize = null;
+            chunks.splice(0);
+        };
+
+        const processData = () => {
+            // Create one big buffer with all all the chunks
+            const stringData = Buffer.concat(chunks);
+            console.error(stringData);
+
+            // The browser will emit the size as a header of the payload,
+            // if it hasn't been read yet, do it.
+            // The next time we'll need to read the payload size is when all of the data
+            // of the current payload has been read (ie. data.length >= payloadSize + 4)
+            if (!sizeHasBeenRead()) {
+                try {
+                    payloadSize = stringData.readUInt32LE(0);
+                } catch (e) {
+                    console.error(e);
+                    return;
+                }
+            }
+
+            // If the data we have read so far is >= to the size advertised in the header,
+            // it means we have all of the data sent.
+            // We add 4 here because that's the size of the bytes that old the payloadSize
+            if (stringData.length >= payloadSize + 4) {
+                // Remove the header
+                const contentWithoutSize = stringData
+                    .slice(4, payloadSize + 4)
+                    .toString();
+
+                // Reset the read size and the queued chunks
+                flushChunksQueue();
+
+                const json = JSON.parse(contentWithoutSize);
+
+                // Forward to desktop application
+                this.ipc.send(json);
+            }
+        };
+
+        process.stdin.on('readable', () => {
+            // A temporary variable holding the nodejs.Buffer of each
+            // chunk of data read off stdin
+            let chunk = null;
+
+            // Read all of the available data
+            // tslint:disable-next-line:no-conditional-assignment
+            while ((chunk = process.stdin.read()) !== null) {
+                chunks.push(chunk);
+            }
+
+            processData();
+        });
+    }
+}

src/services/nativeMessaging.service.ts

@@ -0,0 +1,104 @@
+import { ipcRenderer } from 'electron';
+import Swal from 'sweetalert2';
+
+import { CryptoService } from 'jslib/abstractions/crypto.service';
+import { CryptoFunctionService } from 'jslib/abstractions/cryptoFunction.service';
+import { I18nService } from 'jslib/abstractions/i18n.service';
+import { LogService } from 'jslib/abstractions/log.service';
+import { MessagingService } from 'jslib/abstractions/messaging.service';
+import { PlatformUtilsService } from 'jslib/abstractions/platformUtils.service';
+import { UserService } from 'jslib/abstractions/user.service';
+
+import { Utils } from 'jslib/misc/utils';
+import { SymmetricCryptoKey } from 'jslib/models/domain/symmetricCryptoKey';
+
+const MessageValidTimeout = 10 * 1000;
+const EncryptionAlgorithm = 'sha1';
+
+export class NativeMessagingService {
+    private sharedSecret: any;
+
+    constructor(private cryptoFunctionService: CryptoFunctionService, private cryptoService: CryptoService,
+        private platformUtilService: PlatformUtilsService, private logService: LogService, private i18nService: I18nService,
+        private userService: UserService, private messagingService: MessagingService) {
+        ipcRenderer.on('nativeMessaging', async (event: any, message: any) => {
+            this.messageHandler(message);
+        });
+    }
+
+    private async messageHandler(rawMessage: any) {
+
+        // Request to setup secure encryption
+        if (rawMessage.command === 'setupEncryption') {
+            const remotePublicKey = Utils.fromB64ToArray(rawMessage.publicKey).buffer;
+            const fingerprint = (await this.cryptoService.getFingerprint(await this.userService.getUserId(), remotePublicKey)).join(' ');
+
+            this.messagingService.send('setFocus');
+
+            // Await confirmation that fingerprint is correct
+            const submitted = await Swal.fire({
+                title: this.i18nService.t('verifyBrowserTitle'),
+                html: `${this.i18nService.t('verifyBrowserDescription')}<br><br><strong>${fingerprint}</strong>`,
+                showCancelButton: true,
+                cancelButtonText: this.i18nService.t('cancel'),
+                showConfirmButton: true,
+                confirmButtonText: this.i18nService.t('approve'),
+                allowOutsideClick: false,
+            });
+
+            if (submitted.value !== true) {
+                return;
+            }
+
+            this.secureCommunication(remotePublicKey);
+            return;
+        }
+
+        const message = JSON.parse(await this.cryptoService.decryptToUtf8(rawMessage, this.sharedSecret));
+
+        // Shared secret is invalidated, force re-authentication
+        if (message == null) {
+            ipcRenderer.send('nativeMessagingReply', {command: 'invalidateEncryption'});
+            return;
+        }
+
+        if (Math.abs(message.timestamp - Date.now()) > MessageValidTimeout) {
+            this.logService.error('NativeMessage is to old, ignoring.');
+            return;
+        }
+
+        switch (message.command) {
+            case 'biometricUnlock':
+                if (! this.platformUtilService.supportsBiometric()) {
+                    return this.send({command: 'biometricUnlock', response: 'not supported'});
+                }
+
+                const response = await this.platformUtilService.authenticateBiometric();
+                if (response) {
+                    this.send({command: 'biometricUnlock', response: 'unlocked', keyB64: (await this.cryptoService.getKey()).keyB64});
+                } else {
+                    this.send({command: 'biometricUnlock', response: 'canceled'});
+                }
+
+                break;
+            default:
+                this.logService.error('NativeMessage, got unknown command.');
+        }
+    }
+
+    private async send(message: any) {
+        message.timestamp = Date.now();
+
+        const encrypted = await this.cryptoService.encrypt(JSON.stringify(message), this.sharedSecret);
+
+        ipcRenderer.send('nativeMessagingReply', encrypted);
+    }
+
+    private async secureCommunication(remotePublicKey: ArrayBuffer) {
+        const secret = await this.cryptoFunctionService.randomBytes(64);
+        this.sharedSecret = new SymmetricCryptoKey(secret);
+
+        const encryptedSecret = await this.cryptoFunctionService.rsaEncrypt(secret, remotePublicKey, EncryptionAlgorithm);
+        ipcRenderer.send('nativeMessagingReply', {command: 'setupEncryption', sharedSecret: Utils.fromBufferToB64(encryptedSecret)});
+    }
+}