Web wallet best practices

Question

I'm putting together an ether/erc20 token wallet in a chrome extension but would like to follow best practices with regards to private key security.

I'm using localstorage to handle login and its contents are as follows

Localstorage (no account):
    (empty)

Localstorage (signed out):
    password hash
    encrypted private key

Localstorage( signed in):
    password hash
    decrypted private key
    expiry timestamp for decrypted private key

is there anything intrinsically dangerous about this? I'm using npm packages web3v1 (beta) and crypto-js

Answer 1

Do you mean localstorage as in HTML5 localstorage?

If so I personally would not store a users private key in localStorage.

A malicious piece of javascript such as this,

for (var i = 0; i < localStorage.length; i++){
  $('body').append(localStorage.getItem(localStorage.key(i)));
}

which will use the key method in localStorage.key(index) which returns the index th key to loop through localStorage in a browser and read out all the values.

From my understanding localStorage stays unless you clear it. Perhaps for the last use case use sessionStorage

Localstorage (no account):
    (empty)

Localstorage (signed out):
    password hash
    encrypted private key

Sessionstorage( signed in):
    password hash
    decrypted private key
    expiry timestamp for decrypted private key

That way on browser/session close the decrypted private key will disappear.

Answer 2

I would advice against building your own wallet if you don't have the appropriate security expertise. There are many things that can go terrible wrong when handling secrets in a frontend, a single xss can leak all the secrets, the wrong design approach can leave your extension open to the mercy of any malicious site your user visit ..etc. That said, if you must create a new wallet you should checkout how metamask browser extension is designed and implemented https://github.com/MetaMask/metamask-extension. Metamask has gone through multiple rounds of security review, and has a solid community validation.