I will let their video take care of the explanation part for me because I feel that’s the best way to understand how their service works exactly, and then we will directly jump to the working of the tool. Sounds good? Have a look.
Getting Started
Working on uniclau is very easy, all you need to do is install the uniclau extension on your browser and the app on your mobile. The browser extensions are available for all the major browsers. The page will automatically detect the one you are working on and provide the appropriate download button. The app is available for iPhone and Android users. For the post, I have tested the service using Chrome on the computer and an Android smartphone. Having done that, whenever you visit a page on your browser that requires your user credentials to log in, uniclau extension will show a unique QR code on the page. Now launch the uniclau app on your phone and scan the QR code displayed on the screen. For the first time you launch the app, it will ask you to set up a new PIN and associate the phone to a new email address. After associating the email address you will receive a confirmation mail. When you click on the confirmation link the app will initialize automatically. You can now go on and scan the QR code. After you scan the code your mobile will check if you have the credentials of the page already saved in your account. If you do, you will have to select the credentials from the list (in case you have more than one for a domain) to fill in the username and password field automatically on the browser. If you don’t have it stored already, you will have to provide it manually for the first time, there after the app will take care of it. Note: Please generate a PUK code in the app using the settings and save it on your computer, on an online note keeping service like Evernote. You will have to provide the code whenever you associate a smartphone to your email account in uniclau.
Security Model
In-depth explanation of how the service works is beyond the scope of this post as it can get very complicated. So keeping it simple, here’s how the thing works: When you scan a QR code on a website, the mobile sends the unique session ID to the server. The server then pushes the request to your phone and asks you to select the account you would like to use. Having done that, the credentials are encrypted with a private key and passed on to the web page. On the web page, the decryption takes place and both the username and the password field will be filled up automatically. .
Limitations
The service still needs some refinement. The QR code is displayed on non-login fields as well. For example, the code shows up on Facebook page where it asks you to provide your email address to find friends.Your mobile should be connected to the internet for the service to work. If your device has run out of juice or you are not getting the internet connectivity, you will be left on your own.Unlike LastPass, here you cannot fill forms or generate passwords and store it into the database automatically. For the first time you will have to type in the username and password in your mobile.
Conclusion
So are you going to give the service a try? Don’t forget to share your views on it. Personally, I still prefer LastPass but I will probably keep this service as a backup when I am working on a public computer and want to save some time.
