Our susceptibility to a BadgerDAO-style hack

[mparikh]

Sources( to reduce cross posts)

This topic is talking about local storage :

Frontend security

AgentJS is storing information in localStorage, which makes it possible for the page to reload and still be authenticated. I am not aware of its inner workings, but it doesn’t seem very safe to do that. Chome Extensions XSS attacks; Supply chain attacks; all of these can inject javascript, get access to localStorage and then call all the canister methods they want. Correct me if I am wrong. If you are like “Ohh I don’t use chrome extensions like that”. Let me tell you, pretty much ALL of my ext…

@timo

Now, in some further detail, II actually tries to improve over wallets like MetaMask. Where those wallets store key material permanently on disk (at least encrypted), II doesn’t. II only creates session keys that are valid for 30 min. The permanent keys are inside the biometric sensor or Yubikey. That is an improvement because it shortens the attack window for certain attacks.