PrimalHQ / primal-web-app

Primal's web app for Nostr, as experienced on primal.net.
https://primal.net
MIT License
203 stars 41 forks source link

Storing private key (nsec) without encryption in local storage may be a security risk #99

Open cfahrenholz opened 1 month ago

cfahrenholz commented 1 month ago

Describe the Bug

I attempted to review how the private key is stored locally. From what I could see, it is stored without encryption. This poses a potential security risk if someone gains access to the device and can read or copy the values from local storage.

Expected Behavior

Please consider encrypting the private key provided by the user, for example, using react-secure-storage.

This site also explains the potential security risks involved.

If I have not investigated the code correctly, I apologize in advance.