FF Addon development streamlined

I've done some work on a Firefox extension, and a nice workflow evolved over time. Thought I'd share.

Preparation

Let's call your project's folder proj. Your directory structure would then look like this:

  proj/
   |--bak/
   |--git/  (or svn, or cvs, you get the idea...)
   |--src/ -> installed extension

• src is a symlink to the directory where the extension is installed.
• git is where you'll do the version controll. This is necessary because you'll want to try installing the extension, which will clear out the directory where it's installed - meaning .git, .svn, whatever will be removed as well.
• bak is where you'll back up the src dir before you install the extension in Firefox.

The workflow

1. Make changes in proj/src. Restart firefox, check changes. Repeat as needed.
2. Once a set of changes is done, cp proj/src/* proj/git/ -r. Commit, push, whatever your heart desires.
3. When you want to prepare the package for distribution, do something like this: zip [extension].xpi * -r -x *~ *.zip "#*#" *.js.marks
4. You can now back up proj/src to proj/bak if you want to.
5. Install the extension, check that it's fine.
6. Lather, rinse, repeat

Portable password management

As you surf the web, you'll inevitably accumulate a number of registered accounts. And, if you give any thought to security, you'll probably have a different password for each one. Or at least for groups of them. You do use a different password for online banking and your /. account, do you?

Solutions

Remembering strong passwords is hard. There are, of course, ways to help you with this.

Plain text. Save the passwords in a plain text file. Yes, you can mock me for the rest of my life for having written this. If anyone gets your file, you're in deep trouble. Still, it's a possibility.

Encrypted plain text. This is somewhat better. Unless someone has both the file and a way to decrypt it, they can't access the information. Of course, same goes for you - if you're in a situation where you can't decrypt it (say, in the case of GPG, your key is unavailable), the passwords are effectively lost to you.

Technically halfway between a password manager and encrypted plain text, here's a way from 'minor emacs wizardry' to use Emacs for storing passwords.

Password managers. The old linux.com has a useful article on open-source password managers. They're nice, but this time, instead of just a way to decrypt your passwords file, you have to carry a whole application.

The solution (?)

ClipperZ, an online password manager. First time I heard "online password manager", I had alarms ringing in my head and wanted to run away in terror. Store all my sensitive passwords on a foreign machine, with no direct access to it whatsoever? Well... Yeah. Exactly.

You get a web-based interface, so portability is not a problem here (it works in Firefox, Opera and IE). But security could be. However, having dual-core laptops and high-performance JavaScript engines, ClipperZ pulls off a nifty trick: it encrypts the data on your machine, with JavaScript. The encryption key is your password, the only one you'll have to remember from now on. This way, unless someone has your password, all they see over the wire - and also on the server - is garbage.

The passwords themselves, not needing to be remembered by humans anymore, can be really strong. ClipperZ has a password generator that churns out stuff like 1%?G1yy0S&h;PPrtcoS. You can tell ClipperZ what character groups to use, so if a site accepts only alphanumeric, you can do that too.

What about public terminals? You can't type in your all-mighty master pass-phrase with all those eyes around and possibly a keylogger or two. That's what one-time pass-phrases are for. ClipperZ generates a password like this: 8j2j 9f7c - aq6v kz3a - qmpg pjed - j6wm fm44. You write it down - on a piece of paper, on your hand, whatever. Then you use that when logging in. It even accepts I instead of a 1 and similar typing errors. With such a long pass-phrase, that shouldn't be a security risk.
Once you used the password, it's gone - it can't be used again, not by you, not by anyone else.

Convenience

Security-wise, I think ClipperZ is a good solution - good as in "I can't think of anything better". That might not be good enough for everyone and every situation, but IMHO it's perfect for private use.
I'd love to rant about the great features Clipperz offers, but they have a write-up likely better than something I'd produce. So see the ClipperZ Features page.

Have fun, and safe surfing!

Note: All the passwords presented as examples are genuinely created by ClipperZ. They are, however, not used (well.. by me anyway), so you'd try them out in vain :)