After playing around with
eth-lighwallet library I have a security related question.
- How does one securily store a user password in a browser?
Imagine a situation where a user provides a password and it's used by
eth-lighwallet to sign transactions.
On the one hand, an application can prompt user for password every time
eth-lightwallet needs it. While it's kind of safe, it's a bad user experience.
On the other hand, an application can save a password in a variable/localStorage/sessionStorage and use it on whenever needed basis.
The second scenario seems insecure, because some malicious script can retrieve this password and do whatever it wants, like transfer funds and stuff.