3

After playing around with eth-lighwallet library I have a security related question.

  1. How does one securily store a user password in a browser?

Imagine a situation where a user provides a password and it's used by eth-lighwallet to sign transactions.

On the one hand, an application can prompt user for password every time eth-lightwallet needs it. While it's kind of safe, it's a bad user experience.

On the other hand, an application can save a password in a variable/localStorage/sessionStorage and use it on whenever needed basis.

The second scenario seems insecure, because some malicious script can retrieve this password and do whatever it wants, like transfer funds and stuff.

If only there was a way to store user password in user's browser, so that javascript could set it, but not get it. And the only way to get it was to use a special button that guarantees that the click is coming from a user's mouseclick and not some script.

Improve this question
2
  • 4
    Basically you can't: stackoverflow.com/questions/17280390/…. There's always a tradeoff between user-experience and security, and if a user is putting their crypto keys in a browser, they've clearly decided they care more about UX
    – Tjaden Hess
    Mar 23 '17 at 19:48
  • It is not a question for Ethereum.se at all...
    – Distic
    Dec 12 '17 at 15:18
0

If it can be created by code, then its accessible by code. The only way to achieve what you're thinking of is probably via hardware security.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.