Chrome OS and Passwords

I have been using the CR-48 / Chrome OS for the past few weeks. I really enjoy using the OS but I don't think it could replace my Macbook Air (yet). I agree that the CR-48 is incredibly underpowered and has a terrible trackpad but this is "beta" hardware. I am excited to see how the hardware from Samsung and Acer compare.

My biggest annoyance? ChromeOS breaks my security routine. I currently use Keepass (with Dropbox) to create and store passwords. I trust Google... but I am not comfortable storing my passwords using Chrome sync. Yes, I am storing my password file on another cloud service (which is known to be unencrypted) but I feel safer knowing that my password file is encrypted under my parameters.

I also care about the accessibility of my passwords. The Dropbox + Keepass solution provides access everywhere (Mac, Windows, Linux, Android, iOS). What happens when I cannot use Chrome? I often use other browsers for mobile, cross-browser testing, and accessing different Google accounts. What do you do when you cannot use Chrome that is logged in with your personal account? A web interface would improve accessibility but be an obvious target for attacks, just like LastPass.

Desktop / Web notifications

Inspired by GMail's recent release of Desktop Notifications, I decided to research the feasibility of using them to replace the notification area for an application I work on. Since I develop for a small internal group I can target newer browsers such as Chrome and Firefox.

The W3C specification for Web Notifications is still in draft but outlines the concept well. The website must request permission and then may publish notifications for the browser to display.

Google Chrome / Chromium
Chromium has published their API specification and it closely resembles the W3C specification. The onclick attribute is currently missing and onshow is called ondisplay.

Firefox
Sadly Firefox 4 will not have support for Web Notifications. Bug 594543 is currently tracking the implementation for a future version but does not have a milestone listed. It's slightly concerning that the bug author is already suggesting a deviation from the W3C specification - they would rather include a callback on the Notification constructor instead of implementing the onshow, onclick, onerror, and onclose attributes.

Examples:

• http://0xfe.blogspot.com/2010/04/desktop-notifications-with-webkit.html
• http://www.210computing.com/google/chrome_notifications.html
• http://beakkon.com/tutorial/html5/desktop-notification

The last example uses setTimeout to call cancel after 15 seconds. This seems like a good way to ensure the popup is closed; however, I'm slightly surprised they did not call setTimeout within the Notification's onshow method. Unless the notification is immediately displayed the setTimeout timer is needlessly wasting time. The rationale for this choice may be because there is no guarantee that the onshow method will be called immediately.