Question

I’m doing a mobile WebApp using HTML5. My problem is that the “post-login” pages cached by the HTML5 application cache, from what i understand, remain still unsafe. Is there a solution? What is the best way to ensure an offline authentication hiding user/pass and “post-login” pages from intruders?

Answer 1

I am just starting to delve into HTML5 usage of local storage via the Manifest option (http://diveintohtml5.info/offline.html) and this too is a concern for me as much for privacy as security. Two things came to mind: Ezncrypt and the Editor’s Draft on Web Storage (Privacy and Security), links to both below…

While I do not know if this will be the ‘best’ answer, figured anything would be better than nothing and after all you posted this question back on Feb 2, 2012 and no one else has offered anything.

Caveats (ezNcrypt):
It works on Linux
Its a Commercial product with a 30 day trial, honestly do not know the cost as I am not affiliated with them, just heard of what they do via a local meetup, LAPHP, LAMySQL or LAWebspeed last year, and it sounded interesting enough to note for future reference. Transparent encryption will be huge.

Google Ezncrypt products to get a link, I am limited to two here.

Even if its not the ‘right’ solution for you or others, perhaps it will point you in a good direction with some decent search terms to find more.

If the encryption is handled “transparently” below the application / data layers, it will just work regardless of the IT knowledge of the user.

If you are willing to share some contact information with them, you get this PDF file with 4 case studies, FTP, NoSQL, SQL and something else… its free.

http://blog.gazzang.com/white-paper-unifying-data-encryption-liberating-transparent-encryption-for-any-purpose-/?utm_campaign=Whitepaper&utm_source=Whitepaper

I should get a commission, lol. Hey if it helps us find a solution, that is all that matters.

Whatever your decision make sure you go through the Editor’s Draft, Privacy and Security to dot your i’s and cross your T’s, especially sections 6 Privacy and 7 Security.

http://dev.w3.org/html5/webstorage/#the-localstorage-attribute

Just thought of another, I did not look except to provide a URL to their checklists (cheat sheets) , but my guess is OWASP would have one or two checklists that might lead you to something. Just think of your device as a little desktop/server and see if any of those apply. To bad my Nokia N800 broke on me, a full blown Linux computer in my hand circa 2006 and the new Linux handhelds circa 2012 are so much more powerful. Just use a Linux distro with a small footprint on a device with exchangeable storage (Micro SSD Cards would work…the Nokia N800 had two slots in 2006) and there is no limit to what you could store locally and run offline. Here is the URL to the OWASP checklists:

Sorry limited to two links, google OWASP cheet sheets and you will find them.

If a handheld is truly ‘smart’ you will have root (administrator) access to the device and underlying operating system / file system. Every operating system has methods to encrypt data on the fly, but you have to have access to utilize them. A device that does not give you this access (usually for proprietary reasons, most often to force you to buy a new device in 6 mos to 1 year) is limiting your options artificially for the wrong reasons and is simply not smart. Remember that all versions of Android (Linux) are not open and rootable, so do your homework or you will end up with an expensive paper weight in the near future.

I would recommend only buying smart handhelds that allow for root/admin access.