Storing user passwords for web apps in client-side JavaScript - is this secure?

Tobeck

TL;DR - Store the web app's user login password in memory in JS for use when the user data is encrypted client-side: yes or no?

I am developing a web application where users can store their notes in the cloud. The user has a login password. Additionally , users can choose to encrypt their notes with a password. These notes are stored encrypted in the cloud, which means that only the user can decrypt them (if the password for the note is lost, it will be lost).

For user convenience, it's better to use the same password for account login and note encryption, and store that password in memory in a JS variable when logging in, so that they don't have to re-enter the password every time they enter it. Apps need to encrypt or decrypt anything (for example, if they update a note).

Is this not safe? Yes, an attacker with access to the user's computer can do a memory dump, or insert breakpoints in (uglified) JS, etc., and then get the password. But an attacker with access to the user's computer can still do this: in order to fully log in, it is important to note that the user's password is accessible in plain text in the application's JS.

So it seems ok to me - it's not safe to not store. Any ideas?

silver fox

Yes, JavaScript variables will be protected by the same origin policy, preventing other domains from accessing this data.

Consider storing a salted hash of the password as a JavaScript variable, then use that hash to encrypt and decrypt data in the cloud. This will prevent a local attacker from querying local variables on other people's machines for passwords (e.g. they didn't lock the screen while drinking coffee). Since the attack involves stealing sessions (which is easy to do on an unattended computer), this attack is slightly more risky because the password may have been reused on other sites. You don't want your site to be a weak point for attackers, as it can access other users' Gmail, bank accounts, Facebook, Twitter, etc.

Also consider key expansion to make your encryption key "strong enough". Since the encryption key is a password (called password-based encryption), a key of at least 128 bits of entropy needs to be derived, which is more than what your average user password contains.

Other things to consider in the design:

  • All communications over HTTPS are secured using TLS.
  • For any session cookies, set the secure and HTTP-only flags whenever possible.
  • Use HSTS to ensure future connections from duplicate users are HTTPS only.

Related

Properly transmit and secure user passwords for web applications

Ale: I am developing a web application for my master project. This is a system for professors to manage student projects, it uses Java to write server-side code, HSQLDB for database, JSP for presentation layer, and runs on tomcat. The data that will be stored

Properly transmit and secure user passwords for web applications

Ale: I am developing a web application for my master project. This is a system for professors to manage student projects, it uses Java to write server-side code, HSQLDB for database, JSP for presentation layer, and runs on tomcat. The data that will be stored

Properly transmit and secure user passwords for web applications

Ale: I am developing a web application for my master project. This is a system for professors to manage student projects, it uses Java to write server-side code, HSQLDB for database, JSP for presentation layer, and runs on tomcat. The data that will be stored

How secure is this way of storing passwords?

Michael Shift I understand and realize that storing passwords in my own database is a huge security hole compared to using a service like Google or Facebook, but I would like to know if the following code can be used to use salted hashes to Securely store user

How secure is this way of storing passwords?

Michael Shift I understand and realize that storing passwords in my own database is a huge security hole compared to using a service like Google or Facebook, but I would like to know if the following code can be used to use salted hashes to Securely store user

How secure are client-side SSL certificates in mobile apps?

Jacob Marble I want to have secure communication between my Android/iOS app and my internet access backend service, so I'm looking into HTTPS/SSL. If I create a self-signed certificate, then put the client certificate into the application, and have the backend

How secure are client-side SSL certificates in mobile apps?

Jacob Marble I want to have secure communication between my Android/iOS app and my internet access backend service, so I'm looking into HTTPS/SSL. If I create a self-signed certificate, then put the client certificate into the application, and have the backend

How secure are client-side SSL certificates in mobile apps?

Jacob Marble I want to have secure communication between my Android/iOS app and my internet access backend service, so I'm looking into HTTPS/SSL. If I create a self-signed certificate, then put the client certificate into the application, and have the backend

Use secure passwords on Rails 4 apps

username I am trying to use has_secure_password for user login, I have defined user schema as below require 'digest/md5' class User < ActiveRecord::Base has_secure_password before_validation :prep_emailId before_save :create_avatar_url valid

Use secure passwords on Rails 4 apps

username I am trying to use has_secure_password for user login, I have defined user schema as below require 'digest/md5' class User < ActiveRecord::Base has_secure_password before_validation :prep_emailId before_save :create_avatar_url valid

Is client-side Java inherently less secure than JavaScript?

Dove A series of bugs and vulnerabilities on client-side Java has raised eyebrows among many, causing various versions to be blacklisted by Apple, Mozilla, and others. However, javascript is a less controlled language that requires no static typing. Today, jav

Is client-side Java inherently less secure than JavaScript?

Dove A series of bugs and vulnerabilities on client-side Java has raised eyebrows among many, causing various versions to be blacklisted by Apple, Mozilla, and others. However, javascript is a less controlled language that requires no static typing. Today, jav

Secure web pages with passwords or authentication services

Ahmed Q Albasiri I would like to know if there is a way to password protect web pages developed using simple HTML/javascript. I host the page on netlify, I also tried hosting on Firebase and it works on both ends, but I don't want anyone with the link to be ab

How secure is Firebase Cloud Messaging on the client side?

Natesh Butter It is true that firebase provides client side sdk and server side admin sdk to use Firebase Cloud Messaging. What confuses me is: We include client-side initialization code in public javascript files or script tags. Does anyone not see this initi

How secure is Firebase Cloud Messaging on the client side?

Natesh Butter It is true that firebase provides client side sdk and server side admin sdk to use Firebase Cloud Messaging. What confuses me is: We include client-side initialization code in public javascript files or script tags. Does anyone not see this initi

How secure is client-side HTML sanitization?

PW Kad I've been looking at Pagedown.js lately in hopes of using mark-down on pages instead of ugly read-only textareas. I'm very cautious as it seems easy to trick a converted converter. I've seen some discussions about Angular.js and its html bindings, and h

How secure is client-side HTML sanitization?

PW Kad Lately I've been looking at Pagedown.js for the charm of using mark-down on pages instead of ugly read-only textareas. I'm very cautious as it seems easy to trick a converted converter. I've seen some discussions about Angular.js and its html bindings,

How secure is Firebase Cloud Messaging on the client side?

Natesh Butter It is true that firebase provides client side sdk and server side admin sdk to use Firebase Cloud Messaging. What confuses me is: We include client-side initialization code in public javascript files or script tags. Does anyone not see this initi

How secure is client-side HTML sanitization?

PW Kad Lately I've been looking at Pagedown.js for the charm of using mark-down on pages instead of ugly read-only textareas. I'm very cautious as it seems easy to trick a converted converter. I've seen some discussions about Angular.js and its html bindings,