4 ms·

If your third party libraries are so poisoned that you're leaking localstorage, you've got bigger problems than just localstorage... This argument against using

by warent 6y ago

If your third party libraries are so poisoned that you're leaking localstorage, you've got bigger problems than just localstorage... This argument against using localstorage makes no sense

tmpz22 6y ago
Chrome extensions can also inject code via a content script and gather local storage data. You can't control what extensions people are running.
- minhazm 6y ago
  That also applies to cookies. Users can run any browser or script to access your site and do whatever they want with the cookies.
  - gigaftp 6y ago
    In the context of a compliant web browser you can set a cookie as http only as to disallow access it via Js.
  - Jenk 6y ago
    Not for http-only cookies it doesn't.
  - fractionalhare 6y ago
    No they can’t, refer to the documentation on cookie flags and attributes like httpOnly: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
deleted 6y ago
[deleted]
midrus 6y ago
Security is not black and white. It is a spectrum of possibilities and an arms race between security measures and new attack strategies. So lowering all your barriers because one of them could be already weak is not a good strategy. If you're sending your password in plain text without HTTPs, then saying "ok, nevermind, we already have that problem so let's just not use any CSRF protection" you're just making things worse. Authentication tokens that allow anyone reading them to impersonate you are bad, no discussion about it. Go and google for this if you don't believe me. Ask any security expert (which I'm not). Cookies have the exact same problem. Except if you set the http-only flag in them, which is what I'm advocating for here. You can still use localStorage, just not for security tokens.
- anaphor 6y ago
  You seem to be unaware of the existence of capability based security. https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security

by warent 6y ago

If your third party libraries are so poisoned that you're leaking localstorage, you've got bigger problems than just localstorage... This argument against using localstorage makes no sense

tmpz22 6y ago

Chrome extensions can also inject code via a content script and gather local storage data. You can't control what extensions people are running.

minhazm 6y ago
That also applies to cookies. Users can run any browser or script to access your site and do whatever they want with the cookies.
- gigaftp 6y ago
  In the context of a compliant web browser you can set a cookie as http only as to disallow access it via Js.
- Jenk 6y ago
  Not for http-only cookies it doesn't.
- fractionalhare 6y ago
  No they can’t, refer to the documentation on cookie flags and attributes like httpOnly: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies

deleted 6y ago

[deleted]

midrus 6y ago

Security is not black and white. It is a spectrum of possibilities and an arms race between security measures and new attack strategies. So lowering all your barriers because one of them could be already weak is not a good strategy. If you're sending your password in plain text without HTTPs, then saying "ok, nevermind, we already have that problem so let's just not use any CSRF protection" you're just making things worse. Authentication tokens that allow anyone reading them to impersonate you are bad, no discussion about it. Go and google for this if you don't believe me. Ask any security expert (which I'm not). Cookies have the exact same problem. Except if you set the http-only flag in them, which is what I'm advocating for here. You can still use localStorage, just not for security tokens.

anaphor 6y ago
You seem to be unaware of the existence of capability based security. https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security