My own in-browser encryption project/POC: https://mprimi.github.io/portable-secret/
Discussed here: https://news.ycombinator.com/item?id=34083366
Encrypting Data in the Browser Using WebAuthn
21–23 of 23 posts
Re: Encrypting Data in the Browser Using WebAuthn
#22That is really cool, thanks for a detailed writeup. I try to pay attention to the WebAuthn spec and did not realize this was possible. I suspect that for most people, WebAuthn (esp with synced passkeys) is going to actually make the CI part of CIA possible for end user content on the internet. In practice it solves the UX around key management and device syncing issues - it passes the "your grandmother can use it" te…
> it passes the "your grandmother can use it" test IMO. Indeed, but note that having the token is still rare. It'd be good if browsers exposed TPMs via WebAuth since they're more common on consumer-grade hardware. And also the "minor" thing that having only one strong authenticator makes it super-easy to lose own data just in case the authenticator breaks etc.
> And also the "minor" thing that having only one strong authenticator makes it super-easy to lose own data just in case the authenticator breaks etc.
This is why I mentioned "esp with synced passkeys".
WebAuthn can use - but does not necessarily require - hardware-backed keys. iCloud passkeys are an example of an implementation of "soft" keys that are both transparently backed up and synced across the user's devices. Their interfaces are designed to make them difficult to leak (I'd imagine you'd need root+SIP turned off, or a really good OS bug), but are to my knowledge resident in device memory. This is tradeoff for usability. Grandma is never going to be able to use yubikeys to log into things, let alone set one up.
Re: Encrypting Data in the Browser Using WebAuthn
#23Earlier quoted context omitted.
Edit: This was a misreading, see child comments. You can't actually do this because file:// URLs are not considered a secure context and the Web Crypto API is only available in secure contexts: https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_... You would need to run a local webserver and access it over `localhost`.
Some dirty solution can be spinning up home server just to download web app to your device and let service workers cache everything relevant. And then turn off server to prevent any updates to app. This is of course not very user friendly, but might have some use, if you can't or don't want to have running server 24/7 at your home or secure location. But I don't know, if any browser will let offline apps live for ind…
Another idea would be to use https://redbean.dev/ . For mobile it'd not work, though.