Web wallet best practices

Question

I'm putting together an ether/erc20 token wallet in a chrome extension but would like to follow best practices with regards to private key security.

I'm using localstorage to handle login and its contents are as follows

Localstorage (no account):
    (empty)

Localstorage (signed out):
    password hash
    encrypted private key

Localstorage( signed in):
    password hash
    decrypted private key
    expiry timestamp for decrypted private key

is there anything intrinsically dangerous about this? I'm using npm packages web3v1 (beta) and crypto-js

Answer 1

Do you mean localstorage as in HTML5 localstorage?

If so I personally would not store a users private key in localStorage.

A malicious piece of javascript such as this,

for (var i = 0; i < localStorage.length; i++){
  $('body').append(localStorage.getItem(localStorage.key(i)));
}

which will use the key method in localStorage.key(index) which returns the index th key to loop through localStorage in a browser and read out all the values.

From my understanding localStorage stays unless you clear it. Perhaps for the last use case use sessionStorage

Localstorage (no account):
    (empty)

Localstorage (signed out):
    password hash
    encrypted private key

Sessionstorage( signed in):
    password hash
    decrypted private key
    expiry timestamp for decrypted private key

That way on browser/session close the decrypted private key will disappear.