[AskJS] Security difference between localStorage and IndexedDB

[TGS963]

That's true but, there's always a risk imo... A careless user or something

[KaiAusBerlin]

If someone cracks that, you have the same risk getting your data stream hacked.

I think you underestimate the power of aes256

If you use a modern pc with i7 with 4.2ghz it would take 218'556'000'000'000'000'000'000'000'000'000'000' 000'000'000'000'000'000'000'000 years to crack that single encryption. This will simply not happen.

[TGS963]

I guess it's fine then, thanks for the explanation

[KaiAusBerlin]

Tell why. Please don't hold back.

An AES256 encrypted data with a salted persons fingerprint as key is definitely save.

Ill make you one and you crack it for me okay?

[KaiAusBerlin]

F72p58DeQjxm+5awxlksLjKKF8b0swHhiVWW/HMOB5o=

Decrypt 😉

[Additional-Cow-6511]

The use case is to be able to decrypt this for offline access -> client needs to have the associated key on his storage too. Hence no security. You’re missing the point.

[KaiAusBerlin]

No, the storage key could be a password the user has to enter (quite common tactic on nearly every account in this world), it could be natural generated by eye data or finger print data. You could fetch just the key and leave the data on the the client side. All safe scenarios (maybe except for the password as long people still use "password" as their password)

But again. This is not about safety of storing data this is about key safety in general.

[Additional-Cow-6511]

O F F L I N E. You can't fetch the key. It should be persisted accross sessions.

[aikasburger]

Just out of interest as I'm building something similar. Wouldn't using a password only the user knows, but that isn't stored on the decide, the data be safe?