After playing around with eth-lighwallet
library I have a security related question.
- How does one securily store a user password in a browser?
Imagine a situation where a user provides a password and it's used by eth-lighwallet
to sign transactions.
On the one hand, an application can prompt user for password every time eth-lightwallet
needs it. While it's kind of safe, it's a bad user experience.
On the other hand, an application can save a password in a variable/localStorage/sessionStorage and use it on whenever needed basis.
The second scenario seems insecure, because some malicious script can retrieve this password and do whatever it wants, like transfer funds and stuff.
If only there was a way to store user password in user's browser, so that javascript could set it, but not get it. And the only way to get it was to use a special button that guarantees that the click is coming from a user's mouseclick and not some script.