10

I run an online gradebook. To keep student data private, I transfer all data over https.

Now, I'd like to use localStorage to avoid redundant calculations and server requests. However, according to the HTML5 spec, local storage is unencrypted.

Is there an industry standard for handling user expectations here? I could imagine prompting users with something like "Do you want to use local storage? It will make everything faster, but if your computer is compromised student data could be stolen. If this is a public computer, choose 'No.'"

What trends are there for the UX side of this?

Riley Lark
  • 967
  • 1
  • 8
  • 10

3 Answers3

7

Local storage is a relatively new feature available to web applications, but some kind of 'industry standards' or best practices have already appeared. OWASP HTML5 cheat sheet considering your case states that:

Underlying storage mechanism may vary from one user agent to the next. In other words, any authentication your application requires can be bypassed by a user with local privileges to the machine on which the data is stored. Therefore, it's recommended not to store any sensitive information in local storage.

No matter if the original page is delivered via http: or https:, local access to the machine (or XSS flaw in the website) can extract the information stored in it. So, simply put, you shouldn't put any sensitive / private information.

I'm not aware of any common user confirmation message text concerning confidentiality of local storage, but yours makes it quite clear. But still, I'd recommend against putting sensitive data in localStorage.

Disclaimer: I'm the coauthor of HTML5 cheat sheet.

Krzysztof Kotowicz
  • 4,068
  • 20
  • 30
  • I bring up the https only because users will expect a higher level of security when they see it. Thanks for the advice! – Riley Lark Nov 30 '11 at 05:08
  • I keep thinking, "well, they store other sensitive information on their computer - tax records, work files, etc." If we can educate the user to understand that the browser now has sensitive data, what's the difference between a sensitive file in localStorage and a sensitive file in `C:\My Documents` ? – Riley Lark Dec 02 '11 at 15:14
  • 2
    @RileyLark the difference is that a single XSS flaw (which are common) will never reveal your files, but it can easily reveal anything stored in localStorage of a XSSed site. – Krzysztof Kotowicz Dec 05 '11 at 17:47
4

@Krzysztof Kotowicz has a good answer. I concur with his recommendations.

Another possibility, for web applications that really want to store sensitive information on local storage, might be to store it in encrypted form. The client-side application could encrypt and authenticate it (using a symmetric-key encryption algorithm and a message authentication algorithm), store the encrypted version; to read the data, the client-side software could check the MAC and decrypt. If taking this approach, it is very important to avoid storing the symmetric key on client-side local storage. Instead, the key should be persistently stored on the server; the client can query the server for the key and store the key in memory only, but not in persistent storage.

Encrypting data in local storage has a number of shortcomings and limitations, though, which may make it unattractive in many settings. For instance, it prevents use of the application in disconnected mode. For these reasons, @Krzysztof Kotowicz's advice to avoid storing confidential or sensitive information in local storage is probably the best advice for most web applications.

D.W.
  • 98,420
  • 30
  • 267
  • 572
  • What will prevent XSS from retrieving key from the server and decrypting data from local storage? – Andrei Botalov Jul 07 '12 at 19:45
  • @AndreyBotalov, absolutely nothing! In this context, encryption of local storage will only defend against some threats (such as a case where the user loses their laptop; then at least their data won't be stored in the clear on their device), but not against others (such as a malicious or vulnerable server). Then again, if the server is malicious or compromised, you're hosed anyway, regardless of whether you use local storage or not. – D.W. Jul 07 '12 at 22:31
1

I second the advice from D.W.

You could consider developing what it usually called an "host-proof app" or a "zero-knowledge web app". It looks and behaves like a regular web app, but all user data are locally encrypted by the browser itself before being uploaded. The key for the encryption processes is a passphrase that never gets sent or saved to the server. Therefore no one except the user herself can access the data.

Disclaimer: this could be a biased advice since I'm the co-founder of Clipperz, an online password manager that uses this approach.

You can read more about the architecture of a zero-knowledge web application on the Clipperz website. If you decide to write your own, you can use Clipperz's Javascript library of crypto primitives (AGPL licensed) or use this other crypto library from Stanford.

Community
  • 1
Marco Barulli
  • 31
  • 3