Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm building a chrome app that encrypts user messages on the client. The encryption is performed using the forge js library.
I want to ask for the encryption password once, and use it to encrypt all messages in that session. I have no user management.
Currently I'm storing the password as cleartext in a js variable, which is visible to anyone who opens the Developer Tools.
What's a better way to store the password for the duration of the chrome app being open?
Have a look at this answer. What follows from the answer is the variable stored by your chrome app cannot be accessed by any other page without changing this yourself - everything produces by your app is stored in its own environment. This is applicable to both variables and data storage.
This implies that your app would be as safe as Chrome's environment, which is likely to be the best you can get.
Regarding the password showing up in your browser's Dev Tools: this behaviour is inescapable, as you are using JavaScript for encryption which requires you to at some point load the password as a variable. You could of course try to conceal the password by applying a one-time pad on the password. In this scenario you would store the one-time pad and the encrypted password as variables; the original password can be derived using those two variables. Note that this doesn't make the way you store the password any safer, it solely hides it for the human eye.
