3 ms·
The wallet makers could have required a password and encrypted the data going into localstorage. But then there would be no way to recover that key if the passw
by inhumantsar 3y ago
The wallet makers could have required a password and encrypted the data going into localstorage. But then there would be no way to recover that key if the password was ever lost.
Even with encryption, LocalStorage is not a safe place to store sensitive data though. What if the user clears their browser data?
As an aside: Wallet key management and recovery is one of the biggest issues with web3. Either the UX is great but your keys are in the developer's cloud and protected by password + MFA like everything else or your keys are local-only either encrypted with an unrecoverable password or not encrypted at all.
- lxgr 3y ago> The wallet makers could have required a password and encrypted the data going into localstorage. How would users enter the password (on a website) without exposing it to attackers? If you have a malicious extension installed in your browser, it's game over: No website you visit will be safe. To be precise: Technically, only every site you grant the extension access to is compromised – but the default for extensions all too often is "every site", so users are trained to grant that pretty freely for extensions they consider useful...