Security Attributes - Web PKI

• The components of the Web PKI plugin are installed only from a single, centralized location (https://get.webpkiplugin.com), served over strict HTTPS and rated "A" by SSL Labs.

• The "Web Extension" components are submitted to the official store of each supported browser, where they are reviewed and digitally signed:

  • Chrome Web Store;
  • Firefox Add-ons;
  • Edge Add-ons;
  • Safari App Store (coming soon).

• The main source code of the "Web Extension" components is JavaScript in its original form, neither obfuscated nor minified, so that every operation can be evaluated or audited by third parties.

• The Web PKI plugin ecosystem is developed following programming best practices, in compliance with the requirements of the official Microsoft and Apple platforms.

• The "Native App" components installed on the user's machine are downloaded from the centralized domain and are digitally signed with an EV code signing certificate and a DigiCert timestamp valid for 10 years. As a result, the operating systems trust and authenticate the installation without any security warning.

• The "Native App" components do not need administrator privileges to run.

• The "Native App" components preferably access the user's certificates and keys through the operating system's standard API and certificate store, so PINs and authentication passwords do not pass through the "Native App": they are handled directly between the "Crypto Devices" and the operating system.