Comments (8)
Well, wouldn't a native Dart implementation be more suiting? I would propose to simply use an AES password based encryption of the single items in the local storage. At the point where the IO platforms show the pretty biometric authentication dialogue, the web version could simply display a dialogue asking for the decryption password.
from biometric_storage.
Cool project.
Maybe this fits the need...
https://github.com/jerson/flutter-rsa
- manages the gen of public and private keys
- allows encryption of data against a key and then decryption.
A browser does not have access to the TPP chip in each OS as far as i know. Its funny the powers that be have not allowed it. Might be a chicken and egg problem i suspect.
Anyway, this code works on Flutter Web, Mobile and Desktop.
All naive code is golang and then cross compiled ( to each OS and WASM for the browser) and wrapped by the flutter FFI / Method channel. TO ease the developers burden of refactoring and boilerplate protocol buffer IDL is used as the master IDL, and then reused for the FFI IO between the Flutter layer and the Naive layer.
Its pretty cool code.
--
THis married up with key RIng code that accesses the TPM is pretty much covering a decent gamut of the stuff needed to manage passwords.
from biometric_storage.
Maybe i get something wrong aboute the secure-ls library.. but if I understand it correctly.. it generates a secret encryption key.. which is used for storing data into localStorage.. and then goes ahead and stores that encryption secret right next to it..
imho this is more obfuscation than encryption ... The advantage from using this library on android, ios, macos, windows, linux is to use a secure storage provided by the operating system.. so the application does not have to take care about encryption. These are typically encrypted with the user's password.
I don't think there is a large benefit to obfuscating data into localStorage than to just store it in plain text.. it sounds like giving a false sense a security more than it would benefit anyone . If an attacker can compromise the browser to read your localStorage, they can read your secrets no matter if they are plain text or obfuscated.
The only real solution would be to ask the user for a password, and encrypt the data with that password.. but that doesn't quite fit well with the API right now.
from biometric_storage.
The PIN code seems a good idea at the first sight but there is a major drawback: it can be easily brute forced (unlike a alphanumeric password).
I don't think the feature worth the price.
from biometric_storage.
the pin code does not have to be 4 digits. It could be a password.
from biometric_storage.
A pin code used as the key for AES and not store the pin at all seems to be a better solution. If that does not fit the API, I'd say the API needs to change
from biometric_storage.
API needs to change
feel free to make a suggestion or PR
from biometric_storage.
Maybe i get something wrong aboute the secure-ls library.. but if I understand it correctly.. it generates a secret encryption key.. which is used for storing data into localStorage.. and then goes ahead and stores that encryption secret right next to it.. imho this is more obfuscation than encryption ... The advantage from using this library on android, ios, macos, windows, linux is to use a secure storage provided by the operating system.. so the application does not have to take care about encryption. These are typically encrypted with the user's password.
I don't think there is a large benefit to obfuscating data into localStorage than to just store it in plain text.. it sounds like giving a false sense a security more than it would benefit anyone . If an attacker can compromise the browser to read your localStorage, they can read your secrets no matter if they are plain text or obfuscated.
The only real solution would be to ask the user for a password, and encrypt the data with that password.. but that doesn't quite fit well with the API right now.
I totally agree and would close my issue for now because Secure-Ls is totally the wrong solution here.
It should be a dart-only solution to fit into the existing api
from biometric_storage.
Related Issues (20)
- [Android] EncryptedSharedPreferences HOT 2
- [iOS] errSecAuthFailed on consecutive reads HOT 1
- IOS real device: PlatformException(SecurityError, Error while writing data: -25293: The user name or passphrase you entered is not correct., null, null) HOT 2
- [IOS] biometry was requested only on the first "write" HOT 3
- [Android] Unknown AuthException on Android 13 HOT 7
- Request Error Type for "At least one biometric must be enrolled to create keys requiring user authentication for every use" HOT 1
- Execution failed for task ':biometric_storage:kaptDebugKotlin'. HOT 1
- windows doesn't work with biometric_storage: ^4.1.3 when it's a transitive dependency
- Duplicate class
- Add possibility to invalidate storage after biometric changes
- Add method to check if storage file already exists
- The given test case from biometric_storage/test/biometric_storage_test.dart failed
- How to detect onCancel action?
- FaceId is not considered in Android Platform HOT 2
- Build Error: Lexical or Preprocessor Issue (Xcode): 'biometric_storage/biometric_storage-Swift.h' file not found HOT 7
- Localize Cancel button
- Biometrics Only
- Discussion about the actual work of the plugin HOT 1
- Is this package abandoned? HOT 2
- Namespace not specified trying to move to gradle 8.0
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from biometric_storage.