Imagine web apps that are supposed to work with no or only a few interactions with the web server, for example:
- a browser game in which the player's level and progress are to be saved locally.
- a game, progressive web app or browser extension with the possibility of in-app purchases in which the paid-for, unlocked features are to be saved locally.
In each case, tampering of that critical data on the client side is to be ruled out. E.g., the user should be prevented from "cheating" by accessing and manipulating the local data store, be it the local storage or an IndexedDB, through the developer's console.
I understand that with Web Crypto API the key of let's say, a AES-GCM encryption, can be saved as a special crypto key type in IndexedDB and is hence still usable locally, but can't be viewed due to its opaqueness. However, a naive scheme consisting in the web app saving the crypto key, initialization vector and encrypted player's progress/in-app purchases in IndexedDB could be easily compromised as the user could simply use the key and iv to decrypt and then re-encrypt the data.
Things might improve if the key was stored on the server, but this would defeat the goal of reducing server interaction plus we would need to a scheme preventing the user from requesting that key from the server such as the web app does.
I'd like to pick your brains on this. Do you think what I set out to do is feasible at all, and yes, what would a solution look like?
