I've written a password manager in JavaScript. It works in a browser.
Try it out

Are there any fundamental issues with the concept of a web based password manager?
Should I be concerned if hashes linger in memory longer than they should or is there some fundamental issue with how browsers work that makes this system insecure?

Here is the main source file, if you want to take a closer look.

EDIT: To clarify, this app runs 100% locally, has no external dependencies and doesn't store any information except some settings in a cookie if you want to.
This is a deterministic, hashing password manager.

EDIT 2, to be extra specific: If I store user input in a variable, and the resulting hash in another variable, how plausible is the threat of that information leaking?

  • 2
    I am voting to close this question as too broad. Usually code analysis is out of topic, and analyzing an entire password manager is too broad. – ThoriumBR Jun 14 '18 at 19:24
  • I am not asking a code review, but I've posted the app and the code for context and if someone wants to take a look. My question is in the second paragraph, if you still think it is too broad, I can make efforts to reword it. – markonius Jun 14 '18 at 19:52
  • a) Legal issues, big ones, at least for the users. While there will be differences for different countries, I just thought about my 10 most frequently used passwords, and in all cases there are requirements not to add them to such services. Partially it could get me into jail. b) "Really??" In times of large-scale surveillance by many countries and companies too, this is NOT a good idea. At least if the passwords protect something which is worth the effort to enter a password. And no, your web server will never be as secure as my brain. – deviantfan Jun 14 '18 at 22:04
  • c) Yes, there is an issue with browsers: They are evidently among the most insecure pieces of software - partially because of their complexity nowadays, and partially because the amount of people that are interested in holes (and look for them).because it's the way to infect many people easily. Passwords are used for more things than websites - for such cases adding a browser to the mix weakens everything. – deviantfan Jun 14 '18 at 22:08
  • Have a look at Lastpass, they do exactly what you describe. And they seem to be quite successful in business (although there is a free plan too). – Marcel Jun 15 '18 at 8:20

If someone discovers a vulnerability in a browser that lets an attacker read data across web page/tab boundaries then there's a risk that they'll be able to extract information from it.

A browser is essentially a container for applications so all those security implications apply.

  • How plausible is this threat? Is the possibility of someone reading values stored in variables is JS any greater than the possibility of someone reading another application's memory? – markonius Jun 15 '18 at 9:32
  • Yes, because usually you have multiple tabs open and you have little control over what exactly is being run because web pages have dozens of dependencies, load ads, run flash, render things, and there's just so much running in a web page you have no control over. You have much more control over what applications you run (and install) on your local computer than you have control over what your browser is running. Also, depending on the browser... tabs and JS reside in the same memory region and are not separated whereas different applications at least have their own address space. – mroman Jun 15 '18 at 9:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.