Tony/701 web security key - #702
Conversation
There was a problem hiding this comment.
Hi Tony, thanks for the PR.
I had some difficulty understanding the problem it solves:
- If an attacker can access my browser's localStorage or a copy of it, it seems to imply my local computer is compromised.
- If an attacker is able to use a live same-origin script to access my browser's localStorage, it seems to imply the web app that I am using is compromised.
Are these two scenarios in the scope of solidpod's security requirements?
| // recovered offline. (A live same-origin XSS can still *use* — but not | ||
| // exfiltrate — the key; that is an inherent browser limitation, mitigated by | ||
| // CSP/XSS prevention, not storage.) The cache survives reloads, so the user | ||
| // is not forced to re-enter the key. |
There was a problem hiding this comment.
A live same-origin XSS can still use — but not exfiltrate — the key; that is an inherent browser limitation, mitigated by CSP/XSS prevention, not storage.
The comment is not particularly clear to me. Does the key here refer to the non-extractable AES-GCM key in IndexedDB? If so, does it imply a live same-origin script would still be able to use this AES-GCM key to get the user's security key?
The cache survives reloads, so the user is not forced to re-enter the key.
As a web app user, I actually expect to re-enter my security key after reloading/refreshing.
Hi @cdawei, yes, this is a good point. If the browser's localStorage can be accessed by some other people remotely, that means the computer is compromised, and all security measures are futile. I think these two scenarios are at the boundary of SolidPod’s security requirements. They would be nice to have, but are not essential. I think we could use sessionStorage instead of localStorage in Flutter Secure Storage as you mentioned above, and ask users to re-enter their security keys after reloading/refreshing. This will make things simpler. I'll implement it in another PR. |
|
Close this PR for now, and will submit a new PR after fixing this issue by using sessionStorage to save the security key for the web app. |
2 participants
Pull Request Details
Description
Fixed the issue that the security key can be retrieved from web localStorage.
Related Issues
#701
Type of Change
How To Test?
Run the app on web browser, and follow the instructions in #701
Checklist
make preporflutter analyze lib)dart testoutput or screenshot included in issue #Finalising