Fix deep linking #14

Activity

1. bkeepers commented on Aug 15, 2012

   

   bkeepers

   on Aug 15, 2012

   ContributorAuthor

   More actions

   With the pki branch merged, this issue changed a bit. Now it always redirects to the unlock screen, and then to the root.
2. joeyw commented on Aug 19, 2012

   

   joeyw

   on Aug 19, 2012

   Contributor

   More actions

   One solution to this would be to use sessionStorage for the private keys password, the keypair could then be unlocked between refreshes. The downside of course is the keypair password sitting in plain text.

   Another solution would be to store the current hash whenever we are redirected to the unlock page, then once unlocked, try to load the page.

   If either of these ideas sound good, let me know and I will code it up.
3. bkeepers commented on Aug 21, 2012

   

   bkeepers

   on Aug 21, 2012

   ContributorAuthor

   More actions

   I'm already a little uneasy about security in the browser. Storing the password or decrypted private key makes me even more nervous.

   Would you be willing to do a little research about local storage security? I'd like to know:

   • How is it persisted on disk?
   • How can it be accessed through the browser/extensions?
   • Is there any way to securely store it?
4. joeyw commented on Aug 22, 2012

   

   joeyw

   on Aug 22, 2012

   Contributor

   More actions

   Javascript Cryptography Considered Harmful sheds some insight that maybe interesting to this project.

   1. With that said, localStorage is not suitable for sensitive data. Safari and Chrome use sqlite for storage. For instance, I've ran Swordfish locally and I the private key it generated is stored in plaintext with cat ~/Library/Application\ Support/Google/Chrome/Default/Local\ Storage/http_localhost_3000.localstorage.
   2. There is a same-origin policy for localstorage but XSS and injected extension give up the data easily.
   3. I can't answer this.
5. bkeepers commented on Aug 22, 2012

   

   bkeepers

   on Aug 22, 2012

   ContributorAuthor

   More actions

   I opened up #28 to discuss the security aspects more. In the mean time, I would punt on storing the passphrase or decrypted private key.
6. MikeMcQuaid

   closed this as completedon Nov 1, 2017