Trying to find if there are recognized ways to handle Progressive Web Apps (PWA)/HTML5 type apps on desktop browsers (chrome, firefox) with some form of encrypted local storage that is sufficiently recognized (not a hack per-se) for things like compliance (PCI, HIPAA, NIST, etc). The usecase is sensitive information updated in the morning when connected, then offline-mode during the day and used for review, updates, etc in the field where no internet/connectivity is reliably available, then re-uploaded in the evening when re-connected.

I see things like IBM MobileFirst JSONStore and EncryptedCache, but:

  1. don't want to rely only on brochures.
  2. evaluate all possibilities around offline mobile webapps on desktop and mobile browsers w/ encrypted offline data.

So asking the experts!
(please don't downvote if there are no option, simply provide education/alternatives)

  • what's the point of encrypting the data? you're accessing the data all day right, that (to me) means it's used un-encrypted. If it's offline, why does it even need protection? we encrypt to store, but you're not storing it. to the extent you are, you need to use the device's built-in security, be it full-disk encryption or whatever... – dandavis Apr 26 '17 at 20:41
  • Hi dandavis, to expand on the usecase: if I have a bunch of people I need to review in the field, need to download while in the morning your name, birthdate, social security number, home address, and possible some other compliance datapoints (PCI: Credit card, HIPAA: medical diagnosis). After the morning connection, store it in localStorage/SessionStorage/WebSQL/IndexDB/whatever so it is available offline. The assumption is additional encryption may be desired above and beyond just a laptop encrypted drive. – dhartford Apr 26 '17 at 21:03
  • you can assume a current browser is safe from outside threats. if the web app knows how to decrypt, someone possessing the unlocked device will have access. There's no advantage to or practical mechanism of protecting such in-use local data (afaik), and it's out of band of the kind of problems that need to be individually solved by web developers; trust the gear. that's good news, right? – dandavis Apr 26 '17 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.