My company is currently evaluating a product which comes with a browser-extension-based password manager. The password manager is peripheral to their core product, but is the only way to use it. We're trying to assess their security — we're not going to be storing super-confidential entries, but we do want to make sure there's at least a baseline level of security.
The company that offers the password manager claims that the master key that is used to encrypt/decrypt passwords is stored entirely client-side, and that only the encrypted passwords are stored on the server. However, we've seen a demo, and we know that you don't need to re-enter the master password (which is used to generate the master key) every time you decrypt a password, which indicated to us that the master key is being stored somewhere client-side.
My question is, how can a browser extension be securely storing this master key client-side? Any cookie- or localStorage-based solution would be completely insecure, no? I'm hoping to get a high-level understanding so we know what questions to ask on the security-side of things.