blocks|key|548107|text|据我所知，本地存储并不是存储密码或其他敏感细节的安全场所。查看下面的链接，其中一个人评论了使用javascript+64位编码和解禁方案，但我不知道该方法在多大程度上会对您试图实现的目标有用。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|548108|存储|offset|length|548109|希望这能有所帮助！|548110|entityMap|0|LINK|mutability|MUTABLE|url|https://getsatisfaction.com/apperyio/topics/how_to_save_account_password_securely_on_local_storage^0|0|0|2|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@]|9|@$D|R|E|S|1|T]]|A|$]]|$1|F|3|G|5|6|7|U|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|V|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|O]]]]

As far as i know, local storage is not a secure place for storing the password, or other sensitive details. Check out the link below, one of the person has commented of using the javascript 64 bit encoding and deocding scheme but i dont how far that method will prove to be useful for what you are trying to achieve.

<a href="https://getsatisfaction.com/apperyio/topics/how_to_save_account_password_securely_on_local_storage" rel="nofollow">https://getsatisfaction.com/apperyio/topics/how_to_save_account_password_securely_on_local_storage</a>

Hope this helps!

blocks|key|1548340|text|这是个避雷针问题。有关更多信息，请参见http://blog.elliottkember.com/chromes-insane-password-security-strategy。与Chrome最一致的位置是鼓励用户使用全磁盘加密，并在远离登录计算机时锁定屏幕。对于像扩展(或浏览器)这样的用户代码来说，很难正确地实现安全存储，“正确”的意思是“抵抗任何人可以从互联网下载的密码恢复实用程序”。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1548341|你应该提交功能请求。也许可以公开一个系统级API，它确实提供了与底层操作系统的密钥链类似的安全性。|1548342|entityMap|0|LINK|mutability|MUTABLE|url|http://blog.elliottkember.com/chromes-insane-password-security-strategy|1|http://crbug.com/new^0|J|1Z|0|0|3|6|1|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@$A|Q|B|R|1|S]]|C|$]]|$1|D|3|E|5|6|7|T|8|@]|9|@$A|U|B|V|1|W]]|C|$]]|$1|F|3|-4|5|6|7|X|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]|N|$5|I|J|K|C|$L|O]]]]

This is a lightning-rod issue. See <a href="http://blog.elliottkember.com/chromes-insane-password-security-strategy" rel="noreferrer">http://blog.elliottkember.com/chromes-insane-password-security-strategy</a> for more. The position most consistent with Chrome's would be to encourage your users to use whole-disk encryption and to lock their screen when away from a logged-in machine. It's difficult for userland code like an extension (or a browser, for that matter) to properly implement secure storage, where "properly" means "resistant to a password-recovery utility that anyone can download from the internet."

You should <a href="http://crbug.com/new" rel="noreferrer">file a feature request</a>. It might be possible to expose a system-level API that does provide similar security to the underlying OS's keychain.

blocks|key|1269540|text|如果我对密码进行加密，那么密钥是否也会在本地存储，从而使加密无效？|type|blockquote|depth|inlineStyleRanges|entityRanges|data|1269541|是的，是的，所有客户端的“加密”对用户或任何访问机器的人都是可见的，因此几乎毫无用处。除非是为了混淆的目的--任何有你硬盘拷贝的人都不能马上用纯文本告诉密码。这可能是也可能不是优势，f.ex。如果使用特定于设备的数据来生成加密密钥，例如硬件UID，那么在不知道UID的情况下，获取加密数据的人就无法立即解码。通常情况下，虽然您会假设一个访问“加密”密码的人也可以以某种方式访问该机器，所以总的来说，用户端加密在浏览器中执行时并没有多大意义。|unstyled|1269542|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|H|8|@]|9|@]|A|$]]|$1|E|3|-4|5|D|7|I|8|@]|9|@]|A|$]]]|F|$]]

<blockquote>
If I encrypt the password, won't the key be locally stored as well effectively making the encryption useless?
</blockquote>
Yes, it would and yes, all client-side &quot;encryption&quot; is visible to the user or anyone who has access to the machine and therefore pretty much useless. Except perhaps for the purpose of obfuscation -- anyone with a copy of your hard drive won't immediately be able to tell the password in plain text. This may or may not be an advantage, f.ex. if using device-specific data to generate a key for encryption such as hardware UIDs, someone who gets the encrypted data won't be able to decode it right away without knowing the UID. Generally though you'd assume someone with access to the &quot;encrypted&quot; password would also have access to the machine in some way so all in all, again, user-side encryption doesn't really make a lot of sense when performed in the browser.

I'm writing an Chrome extension right now which autofills credentials similar to Chrome's autofill (in which case Chrome's autofill fails).

Is there a secure way to store the username/password in localstorage (all client-side)? If I encrypt the password, won't the key be locally stored as well effectively making the encryption useless?

Effectively, I want the user's credentials to be as secure as they would be if Chrome itself was storing the credentials in its password manager.

EDIT: is storing the encrypted password in localstorage and the key in a text file within the extension directory a safe idea?

How to store a password as securely in Chrome Extension?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我现在正在编写一个Chrome扩展，它将自动填充凭证，类似于Chrome的自动填充(在这种情况下，Chrome的自动填充失败)。是否有一种安全的方法将用户名/密码存储在本地存储(所有客户端)？如果我对密码进行加密，那么密钥是否也会在本地存储，从而使加密无效？实际上，如果Chrome本身将凭据存储在密码管理器中，我希望用...

问如何在Chrome扩展中安全地存储密码？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在Chrome扩展中安全地存储密码？EN