I’m building an open-source notes app using electron.

I’ll be using rxdb which uses crypto-js to encrypt fields using AES-256 after getting a passphrase and using pbkdf2 to generate a key. Rxdb is a document store in the browser.

I saw a couple of issues, mainly around the passphrase being compromised and all the data being compromised.

I’m going to introduce the ability to provide another encryption round using a note level password like a lock note function but that field is already locked anyway because they all are under the master password but it gives the opportunity to specify a different one for special use cases.

Over and above that I’ve created a library that allows a pepper to be generated and saved in the OS key store which can be combined with the master passphrase, the hope being that even keylogging a passphrase would still mean the database is not compromised if lifted unless they Keystore is also compromised.

For reference: https://www.npmjs.com/package/pepper-keychain

The question is can I do anything else to harden this? I’ll probably integrate with Yubikey at some point but I’d like it to work independently first.

Mainly I’m a bit lost around how I can improve the validation and given the data is not moving around do I need to worry about this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.