fortis-lock

A Chrome extension that acts as a browser privacy firewall. It disguises protected websites as DNS errors and unlocks them via biometric authentication through the Fortis Agent.

Overview

fortis-lock intercepts navigation to protected domains and replaces the page with a convincing Chrome DNS error screen (DNS_PROBE_POSSIBLE). To unlock:

1. Click the error code text 3 times — this reveals the authentication prompt
2. Click "Authenticate" — this sends a biometric challenge to fortis-agent
3. The agent relays the challenge to your phone via gRPC
4. Scan your fingerprint on fortis-mobile — the website unlocks instantly

No master passwords to remember. Pure push-to-unlock biometrics.

Prerequisites

Requirement	Version
Node.js	20+
Chrome	120+ (Manifest V3)
fortis-agent	Running locally on port 8023
fortis-mobile	Paired and connected

Install & Build

cd fortis-lock

# Install dependencies
npm install

# Build the extension
npm run build

Load in Chrome

1. Open Chrome and navigate to chrome://extensions
2. Enable Developer Mode (toggle in top-right)
3. Click "Load Unpacked"
4. Select the fortis-lock/dist folder
5. The FortisLock extension icon will appear in your toolbar

Usage

Adding Protected Domains

1. Click the FortisLock icon in the Chrome toolbar → opens the Popup
2. Or right-click the icon → Options → opens the Dashboard
3. In the Dashboard, add domains you want to protect (e.g., reddit.com, twitter.com)
4. Set the protection mode:
   • ASK — Prompt for authentication each time
   • PERMANENT_ALLOW — Always allow (whitelist)

Unlocking a Protected Site

1. Navigate to a protected domain — you'll see a fake DNS error page
2. Click DNS_PROBE_POSSIBLE 3 times
3. Click "Authenticate" to send a biometric push to your phone
4. Approve on your phone — the site unlocks with a 5-minute session

Panic Lock (Ctrl+Shift+L)

Press Ctrl+Shift+L to instantly revoke all active sessions and lock every protected tab.

Architecture

┌─────────────────┐     ┌──────────────────┐     ┌──────────────┐
│  Lock Screen     │────▶│  fortis-agent    │────▶│ fortis-mobile │
│  (lock.html)     │HTTP │  POST /auth/     │gRPC │ (fingerprint) │
│                  │◀────│  unlock          │◀────│              │
│  ✅ Unlocked!    │     └──────────────────┘     └──────────────┘
└─────────────────┘

Project Structure

fortis-lock/
├── package.json
├── vite.config.ts
├── public/
│   └── manifest.json         # Chrome Manifest V3
├── popup.html                # Extension popup UI
├── dashboard.html            # Options/settings page
├── lock.html                 # Fake DNS error + auth screen
├── src/
│   ├── background/
│   │   ├── index.ts          # Service worker (navigation interception)
│   │   ├── rules/            # Domain rules engine
│   │   ├── sessions/         # Session management
│   │   └── storage/          # Chrome storage abstraction
│   ├── ui/
│   │   └── lock/
│   │       ├── main.tsx      # Lock screen entry point
│   │       ├── LockScreen.tsx # Fake error + biometric auth UI
│   │       └── LockScreen.css
│   └── lib/
│       └── crypto/           # PBKDF2 utilities (legacy, now unused)
└── dist/                     # Built extension (load this in Chrome)

Permissions

The extension requests the following Chrome permissions:

Permission	Reason
storage	Persist rules and session data
webNavigation	Intercept page navigations to protected domains
tabs	Redirect protected tabs to the lock screen
declarativeNetRequest	Block requests to protected domains
http://127.0.0.1:8023/*	Communicate with the local fortis-agent daemon