如何使用greasemonkey安全地存储密码？

Question

I wrote a Greasemonkey script, it prompts users to store login and password to avoid the need of re-enter it again and again.

I know localStorage.setItem(); to store a key and a value, but the password will be stored as clear text. So, what is the best practice to store a password?

Is there any API to store it in the browser ? I need to be able to revert the hash (if I need to hash) because the script implement autologin on a website, and I need the clear password to do so.

Thanks by advance.

Answer 1

GreaseMonkey and JS are not the right tools for this - there are numerous problems in keeping passwords secure, some of which aren't really solvable in JS (due to its browser sandbox limits).

You could encrypt the password(s) using AES (or some other encryption scheme) - there are AES implementations in JS . However, they are slower than native code, and you'd need to enter the AES passphrase on every page where the password(s) would be needed (if you stored the passphrase somewhere, or stored some token "passphrase was valid", you're back to square one).

As GM is intended for extending in-page JavaScript, its options in security are very limited. If you're trying to save your web passwords securely, I'd suggest some kind of browser extension - there are numerous for existing password managers.