1

I am currently working on a service which lets users store client-side encrypted data and access it anywhere. The client connects through a browser and the webapp is written in JavaScript. To easier manage the stored data, I'd like to implement a search function.

The whole concept of the server not knowing what is stored means that data is not searchable server-side. Therefore the data has to be decrypted somehow.

  • Is it safe to decrypt all the data and store it in memory for the time of the clients session (store it in a variable)?

For user-experience related reasons, asking for the users password (encryption key) every time is not something that'd work I'm the long run.

1

Off the top of my head, I can think of four ways this strategy could fail. All can be mitigated to some degree through sound development practices and commonsense on the part of users, and a few would require some very targetted attacks, but they are risks nevertheless.

Eval

Storing confidential data on the heap will be risky if you intend to use eval, because code running under eval can access variables in the scope of the eval call, which might include your heap variables. Consider:

var creditCardNumber = 123456789;
var evalString = "window.alert(creditCardNumber)";
eval(evalString); // alerts the credit card number!

There are a couple of ways a malicious user might mount an attack:

  • If evalString is fished out of a database, an attacker might try and influence that data somehow
  • If your application uses third party code, an attacker might try and hijack that resource and use eval to grab the data and send it forwards (remember: code running from different scripts will still share the selfsame heap). This risk might be mitigated if the confidential data is somehow held in a closure rather than exposed directly on the heap, but such practices would be easy for a naive developer to break.

Remember that calling window.setTimeout and window.setInterval with string arguments are aliases for eval too.

Browser extensions

Browser extensions may be given the opportunity to inspect the contents of the JavaScript heap, directly or indirectly. For instance, Chrome provides a debugging API for extensions built as developer tools. Users must give permissions to use these extensions, though, and install them purposefully, so this might not be a simple way to mount an attack.

Reverse engineering

Even minified code can still be reverse engineered, so it's always possible for malicious users to reason about how you're performing encryption and the way your JavaScript application handshakes with the server.

Accidental exposure through third party code

You may be confident that your code never assigns creditCardNumber to something persistent like localStorage or serializes it to JSON and pushes it to window.name, but are you similarly confident about third party code? It might be worth checking if you're passing the object around, particularly if you're passing it to something that tries to perform caching.

0

You could use a JavaScript encryption library for the encryption/decryption process, and you could store the unencrypted data in sessionStorage in the browser. Is it secure? Only as secure as your app, the browser, the OS, and the machine it is running on.

Storing the encryption key in the user's browser, let's say in localStorage, so that it persists between sessions, is inherently less secure than asking the user for the key with every session. You might want to offer your users the ability to store the key in localStorage as an option, but I would not make it mandatory.

  • My only concern is storing the data in memory during an active session. All data is heavily encrypted and stored on the server. The key or unencrypted data is never transferred anywhere. When the data does get decrypted by the user, is it safe to store the data in memory? Nothing should ever persist. So to be specific: can I store the data in a variable for the time the user uses the site? For UX it would simplify a lot – Alex Apr 6 '15 at 11:42
  • Alex, yes, you can safely store data in a JavaScript variable in the browser during an active session. That data will not persist beyond the browser window being closed. Whether it persists beyond the active session depends on how you handle it, e.g. you need to clear the data manually when a user logs out. – Robert Munn Apr 6 '15 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.