Switch to ArdorForum

Quote from: Riker on October 31, 2016, 11:16:02 am

Quote from: toenu on October 31, 2016, 10:31:09 am

Quote from: Riker on October 31, 2016, 08:57:09 am

Quote from: toenu on October 30, 2016, 04:47:56 pm

The concern is of course someone getting access (physical or otherwise) to one's device and reading the browser's local storage, which is trivial to do. It's the same as storing it in a clear text file, but after logging in once the user might not even be aware his passphrase is lying around unencrypted on disk... I hope this isn't going to cause any problems.

Perhaps a better way is to save the passphrase only for the session and keep only the account ID permanently. Downside is of course you always have to supply the pass for forging

Is it really trivial to read the device browser local storage?
At least the data saved in disk and memory should be encrypted in most modern browsers.
You'll have to take control over the webview component and development tools while connected to the NXT client in order to steal the passphrase.
Can you do that without root access to the device?

The alternative is that users constantly copy/paste or QR scan the passphrase which opens the door for copy/paste or camera hacking which is not less dangerous.
Steal I don't recommend to store the passphrase of a high balance account on the device.

Browsers don't encrypt local storage by default. What would they encrypt it with, unless the user has some sort of master password? An attacker only needs file system access.

I tried to find where it is stored on disk - chromium on ubuntu stores it's in the folder ~/.config/chromium/Default/Local Storage, where for each website there is an unencrypted SQLite DB. Retrieving it is as simple as opening it with an SQLite browser: http://i.imgur.com/wIHjzhI.png
For other browsers/OS it will be similar.

This appears a great risk, as these files may lay around indefinitely without the user knowing it (and closing tabs is probably more common than logging out)

I agree, the local storage data is not encrypted just obfuscated, still you need to hack into the workstation or device itself to get to it.
The original plan was to save the passphrase in the local storage only for accounts with a balance of less than 10K NXT, and we can also make this limit configurable.
But this does not take into account asset value and other holdings. I guess it's better than nothing.

Another way could be to clear the pass from storage on window close event, unless the user has set something like "keep passphrase in local storage" on the settings page, which by default is false. If the user comes back and the passphrase was cleared, log him in with account ID only.