Wondering if anyone's got a novel solution to this challenge. Barring any browser-specific hack, or XSS attack, I believe encrypted data in memory and in LocalStorage is safe from everything but extensions. Please correct me if I'm wrong.
This brings us to malicious browser extensions that have unfettered access to both LocalStorage and possibly memory.
Defenses:
LocalStorage - I would think a layer of encryption that requires a short-lived memory-resident password from the user to decrypt. Any other suggestions or insights would be most welcome.
Memory - This is the question I'm most interested in. Can a malicious browser extension probe Blazor's memory (akin to a DOM scan)? Or is Blazor a separate untouchable region and the chrome extensions only have access to the Interop Javascript? I know I suggested keeping data encrypted in memory as well, mostly to deter pagefile leaks, but there will be moments when blazor legitimately needs to decrypt/use that data in memory, and that's where I'm wondering if a malicious browser extension can get ahold of it.