Secure browser storage

Question

Where is a secure place to store a "secret" in a web browser that a User has access to and JavaScript does not?

Thinking was along the lines of web history, bookmarks, built in password manager & cache.

Edit:

Secure: HttpOnly Cookie as below is an option, but unless a User uses an addon (firebug), they cant easily access the data although access is technically possible.

Insecure: Web history doesn't appear to be a valid store as JavaScript has access to it.

Unsure: Browser bookmark

Clarification on use case:

1. User registers for a web app (Username, Password), server only stores username & resulting passphrase encoded key.
2. User redirected to a confirmation page, with their resulting passphrase encoded key. (Secure storage applies here.)
3. User logs in with their Username, Password & Passphrase encoded key. Password decodes key which is used for encryption.

Assumptions:

• Password is hardended using a password strengthing algorithm into a passphrase.
• Storage should be optional and use should have a way to opt in/out. (Using Bookmark, this could be as simple as click here to bookmark the passphrase.)
• No server side logging on the login & confirmation pages. (Caching will be disabled)
• All communication over SSL/TLS

Answer 1

The only thing that fits your requirements is HttpOnly cookies. They can be normally exchanged in the HTTP headers, can be easily accessed by the user (you know, being client-side), but it is enforced by all major browsers that these cookies cannot be accessed by normal JavaScript running in the page (for example, document.cookie).

A closer look at your question shows that you already understand that if something is in the browser, it will be accessed by the user and there's nothing you can do about it. In the case of HttpOnly cookies, the browser itself regulates access to them and it imposes strict security rules preventing normal JavaScript code from accessing them. Addons and plugins have normal unregulated access to these cookies because they run on a higher "security clearance level".