Blazor Wasm Data Protection

Viewed 44

Wondering if anyone's got a novel solution to this challenge. Barring any browser-specific hack, or XSS attack, I believe encrypted data in memory and in LocalStorage is safe from everything but extensions. Please correct me if I'm wrong.

This brings us to malicious browser extensions that have unfettered access to both LocalStorage and possibly memory.

Defenses:

LocalStorage - I would think a layer of encryption that requires a short-lived memory-resident password from the user to decrypt. Any other suggestions or insights would be most welcome.

Memory - This is the question I'm most interested in. Can a malicious browser extension probe Blazor's memory (akin to a DOM scan)? Or is Blazor a separate untouchable region and the chrome extensions only have access to the Interop Javascript? I know I suggested keeping data encrypted in memory as well, mostly to deter pagefile leaks, but there will be moments when blazor legitimately needs to decrypt/use that data in memory, and that's where I'm wondering if a malicious browser extension can get ahold of it.

2 Answers

Because you run in the browser, you should assume anyone can read the data. Same is true for mobile applications.

The browser is a public client that can't hold any secrets and you can't know if for example the WASM code is executing in a browser or in some third-party "debugger" that simulates the WASM code.

What data do you want to protect?

Keep one thing in mind:

Anything on the user side can be accessed by him/her or by anything else

Related