Security & boundaries

Two independent security layers

CloudDock uses verified email, workspace membership, account assignments and optional application TOTP. AWS independently authenticates the person using its console and enforces AWS MFA and IAM permissions.

Browser isolation

The Firefox extension uses a separate persistent container for each CloudDock user, workspace, account and IAM login identity. Containers separate cookies and site state; they are not operating-system security environments. Cookies remain in Firefox. Local malware and administrators with access to your OS account remain outside this protection boundary.

Encrypted local vault

AWS passwords and the extension pairing key are encrypted with AES-256-GCM using a master passphrase and PBKDF2-SHA256 with 600,000 iterations. The non-extractable key stays in extension memory. Inactivity, restart or background suspension locks the vault. CloudDock cannot recover a forgotten master passphrase. Credential filling is opt-in and restricted to recognized official AWS IAM forms after a fresh authorized launch. Current GET-based OAuth forms require manual submission.

Honest session reporting

Last opened means a tab or browser open was reported by the extension or companion. It does not prove AWS authentication succeeded or that a session remains valid. Normal browser tabs do not guarantee isolated sessions.

Launch authorization

One-time tickets expire after sixty seconds and require a paired, non-revoked device. The server rechecks membership, account assignments and URL policy at redemption. Revocation prevents future launches; it cannot terminate an already authenticated AWS session. Sign out in AWS and clear the local profile separately.

Before production

Run an independent security review, configure HTTPS, SMTP, backups, trusted identity provider origins, Stripe and Mozilla-signed extension distribution. Read the repository threat model and verification checklist for deployment responsibilities.