[Question] For web, how is the unique encryption key generated and securely reused?

[timmolter]

Looking at this file: https://github.com/mogol/flutter_secure_storage/blob/develop/flutter_secure_storage_web/lib/flutter_secure_storage_web.dart#L93,

it looks like a random key is generated and stored, but how is that raw key protected?

[tim-eucalyptus]

For example what would prevent a hacker or virus software from reading the browser's localStorage file/database? AFAIK localStorage is not encrypted itself by the operating system or otherwise.

Here: https://github.com/mogol/flutter_secure_storage/blob/bdd191faa0ac5e53470e0dd0409849d9ff310a95/flutter_secure_storage_web/lib/flutter_secure_storage_web.dart#L115C29-L115C29

, we see that the encryption key is stored right next to the data stored in localStorage.

[janosgy]

Is it really the case? Then what's the point of encrypting data if the encryption key is stored in the same location?

[polanfong]

Keen to hear what can be done here as @janosgy has stated above.

[juliansteenbakker]

I am closing all older issues. If this issue still exists in the latest version, please let me know.