手机上本地存储（html5）的安全性？

Question

if you write data to local storage with javascript on Android like this:

localStorage.data = "test";

Can this data be access and viewed in some way? I have some important data to save like user personal information and I would not like for anybody to see this data (even if they put some effort in this). Solutions?

Answer 1

There aren't protected at all if you have access to the browser.

Anybody connecting to your site from the user's browser can simply type console.log(localStorage) in the developer's tools (use Ctrl-uppercase-i on most browsers) to see it in clear.

A solution might be to encrypt the data using a server provided key, but this wouldn't be so secure : it's easy (for example using an extension) to change the executed javascript once you get access to the browser (and you have the user to come back to the site). I'd suggest to store on the server those data.

Answer 2

I assume you are talking about a technical exploit rather than someone physically getting hold of the actual device?

If so, it is my understanding that only code on the domain from which the data was saved can access it. So you'd potentially be vulnerable is someone managed a XSS attack or you incorrectly included someone else's script.