14

I'm looking into an offline web app solution using HTML5. The functionality is everything I need BUT the data stored can be directly queried right in the browser and therefore completely unsecure!

Is there anyway to encrypt/hide so that the data is secure?

Thanks, D.

user317077
  • 184
  • 1
  • 1
  • 4
  • Please see also here: http://stackoverflow.com/questions/5976046/html5-client-side-data-encryption-what-are-my-options/6686558#6686558 – user832834 Jul 13 '11 at 22:47

3 Answers3

20

There are two concerns to local storage in HTML5 -

  1. One website reading offline data that another website has stored in a users browser
  2. An end user querying your websites offline data directly

For 1, browsers enforce the same-domain restrictions to localStorage (or the sqllite database support that safari has), so other websites won't have access to the data that you store. However, do remember that if your site has XSS vulnerabilities, it would be possible to steal the data.

For 2, you can't prevent it. Its just like a cookie - the user can chose to view/delete/modify it.

Encryption of data is possible (see http://farfarfar.com/scripts/encrypt/), but pointless. You cannot have a single, global key/password - because an attacker can easily figure the key from javascript code. Using a user-entered password to encrypt/decrypt is possible, but client-side encryption libraries aren't mature or tested well enough. There are likely tons of way to break it.

So, for now atleast, don't store sensitive data in localStorage.

Sripathi Krishnan
  • 30,948
  • 4
  • 76
  • 83
  • 2
    http://code.google.com/p/gwt-crypto/ is mature crypto library safe for use in client-side code (though it uses GWT) – Tyson Dec 31 '11 at 06:10
5

You can also see an article on this concern by the author of the HTML5 SecureStore Porposal

Cbe317
  • 1,229
  • 1
  • 8
  • 9
2

If you're storing data on the user's computer, the user can always read it, no matter how much you encrypt it [assuming you aren't using a hash...]

Sensitive data goes on the server-side, always.

Warty
  • 7,237
  • 1
  • 31
  • 49
  • 1
    Not necessarily. If the encrypted data can only be decrypted with a key that you have to get from the server every time (ie., it's not stored anywhere in JS or on the page), and if the server only provides the key when user is securely authenticated, then between user's legitimate sessions the locally encrypted data is secure. – Mr. TA Feb 15 '13 at 20:50
  • Hashing is not encryption either. – Nisk Apr 28 '13 at 13:59
  • @drogon sure but something is better than nothing – Mr. TA Dec 17 '14 at 23:01