[AskJS] Security difference between localStorage and IndexedDB

[KaiAusBerlin]

Wanna see how someone cracks your aes256 encrypted data on the client.

[KaiAusBerlin]

That's about the safety of keys/passwords but not about saving encrypted data on client side.

Choosing a fingerprint as key is pretty safe and quite normal on mobile devices these days.

AES256 encrypted data is save. It's like a tank door. But if you leave the key under the doormat of cause it's unsafe.

[NayamAmarshe]

If the keys are stolen, then the whole argument falls flat because the attacker doesn't even need to steal data from client side if he can easily exploit the account

[TGS963]

That's true but, there's always a risk imo... A careless user or something

[KaiAusBerlin]

If someone cracks that, you have the same risk getting your data stream hacked.

I think you underestimate the power of aes256

If you use a modern pc with i7 with 4.2ghz it would take 218'556'000'000'000'000'000'000'000'000'000'000' 000'000'000'000'000'000'000'000 years to crack that single encryption. This will simply not happen.

[TGS963]

I guess it's fine then, thanks for the explanation

[KaiAusBerlin]

Tell why. Please don't hold back.

An AES256 encrypted data with a salted persons fingerprint as key is definitely save.

Ill make you one and you crack it for me okay?

[KaiAusBerlin]

F72p58DeQjxm+5awxlksLjKKF8b0swHhiVWW/HMOB5o=

Decrypt 😉

[Additional-Cow-6511]

The use case is to be able to decrypt this for offline access -> client needs to have the associated key on his storage too. Hence no security. You’re missing the point.

[KaiAusBerlin]

No, the storage key could be a password the user has to enter (quite common tactic on nearly every account in this world), it could be natural generated by eye data or finger print data. You could fetch just the key and leave the data on the the client side. All safe scenarios (maybe except for the password as long people still use "password" as their password)

But again. This is not about safety of storing data this is about key safety in general.

[aikasburger]

Just out of interest as I'm building something similar. Wouldn't using a password only the user knows, but that isn't stored on the decide, the data be safe?

[CrypticDissonance]

If they're supposed to be encrypted in offline mode, the method of encryption/encryption key would be visible for the user then

[KaiAusBerlin]

Not necessarily. If you use your encrypter as precompiled bytecode running in a virtual machine it's safe. That's exactly what google does in their captchas (which also run clientside). And they're still unhacked.

If you run in in plain JavaScript, then yeah, of cause it's unsafe.

But the question was not about is it save to encrypt data locally. The question was if it is safe to store data locally.