0

I'm putting together an ether/erc20 token wallet in a chrome extension but would like to follow best practices with regards to private key security.

I'm using localstorage to handle login and its contents are as follows

Localstorage (no account):
    (empty)

Localstorage (signed out):
    password hash
    encrypted private key

Localstorage( signed in):
    password hash
    decrypted private key
    expiry timestamp for decrypted private key

is there anything intrinsically dangerous about this? I'm using npm packages web3v1 (beta) and crypto-js

0

Do you mean localstorage as in HTML5 localstorage?

If so I personally would not store a users private key in localStorage.

A malicious piece of javascript such as this,

for (var i = 0; i < localStorage.length; i++){
  $('body').append(localStorage.getItem(localStorage.key(i)));
}

which will use the key method in localStorage.key(index) which returns the index th key to loop through localStorage in a browser and read out all the values.

From my understanding localStorage stays unless you clear it. Perhaps for the last use case use sessionStorage

Localstorage (no account):
    (empty)

Localstorage (signed out):
    password hash
    encrypted private key

Sessionstorage( signed in):
    password hash
    decrypted private key
    expiry timestamp for decrypted private key

That way on browser/session close the decrypted private key will disappear.

  • how would that malicious javascript enter the page – nick carraway Feb 23 at 3:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.