Where is a secure place to store a "secret" in a web browser that a User has access to and JavaScript does not?
Thinking was along the lines of web history, bookmarks, built in password manager & cache.
Edit:
Secure: HttpOnly Cookie as below is an option, but unless a User uses an addon (firebug), they cant easily access the data although access is technically possible.
Insecure: Web history doesn't appear to be a valid store as JavaScript has access to it.
Unsure: Browser bookmark
Clarification on use case:
- User registers for a web app (Username, Password), server only stores username & resulting passphrase encoded key.
- User redirected to a confirmation page, with their resulting passphrase encoded key. (Secure storage applies here.)
- User logs in with their Username, Password & Passphrase encoded key. Password decodes key which is used for encryption.
Assumptions:
- Password is hardended using a password strengthing algorithm into a passphrase.
- Storage should be optional and use should have a way to opt in/out. (Using Bookmark, this could be as simple as click here to bookmark the passphrase.)
- No server side logging on the login & confirmation pages. (Caching will be disabled)
- All communication over SSL/TLS