Security implications of storing client-side generated passphrase in chrome.storage.local

Question

I've read through the documentation here which warns about the danger of storing secure information in chrome.storage.local since it is unencrypted.

For my application, the extension generates a passphrase for the user locally using a Javascript library packaged with the extension. That passphrase is then stored in chrome.storage.local and is never passed to a remote server via the extension. I understand there are security implications because this is unencrypted and the application is still under development. The purpose of this post is to discover the best security scheme possible.

The specific questions are...

• What are the methods (attack vectors) one can employ to access chrome.storage.local outside of the extension itself?

• Besides the risk of the client running the extension being compromised by a malicious script or application locally, is there a risk of a remote attack?

Thanks in advance for your help.

Answer 1

Anyone with physical access can read the contents of the chrome.storage.local, however by design there is no way for another extension to access the data from your extension, or for a malicious site to directly access the data.

It is not impossible though - there could be some zero-day vulnerability that allows this to occur.

There is always some risk of remote attack that results in control of the device. Once this occurs, the same answer as above applies, i.e. someone with control of the device can read the local storage.

Its worth noting that Chromebooks have better protection against the above in that the underlying device storage may in fact be encrypted, and the attack surface for gaining direct access to that storage is very small. However, other devices do not have these protections.