14 ms·
it doesn't say that anywhere indeed, but this is my understanding: if you reload the page your login is being preserved without re-entering your password. there
by astaza123 6y ago
it doesn't say that anywhere indeed, but this is my understanding: if you reload the page your login is being preserved without re-entering your password. there's no way to maintain this without storing a key on the server (i.e. either the master key (MK), or a key that encrypts the MK, if the MK is stored locally
- sealeck 6y agoCan't you store it in LocalStorage or IndexedDB
- astaza123 6y agoyou can. however, i hope they don't store it unencrypted - it's a very bad security practice for many reasons. assuming they store it encrypted with a temporary session key, the session key will necessarily be on the server. honestly, storing it on the server in a session storage is not a big deal. my original points are that a) web security is hard b) web e2ee is sort of hype on practice
- sealeck 6y agoFrom what I understand they store it unencrypted on the web, but in the device's keychain when using the Desktop application.