title: Can local storage ever be considered secure?
body: <p>I'm required to develop a web application that will function offline for long periods. In order for this to be viable I cannot avoid saving sensitive data (personal data but not the kind of data you would only store hashed) in local storage. </p>
  
  <p>I accept that this is not recommended practice, but given little choice I'm doing the following to secure the data:</p>
  
  <ul>
  <li>encyrypting everything going into local storage using the stanford javascript crypto library and AES-256</li>
  <li>the user password is the encryption key and is not stored on the device</li>
  <li>serving all content (when online) from a single trusted server over ssl</li>
  <li>validating all data going to and from local storage on the server using owasp antisamy project</li>
  <li>in the network section of the appcache, not using *, and instead listing only the URIs required for connection with the trusted server</li>
  <li>in general trying to apply the guidelines suggested in the OWASP XSS cheat sheet</li>
  </ul>
  
  <p>I appreciate that the devil is often in the detail, and know there is a lot of scepticism about local storage and javascript-based security in general. Can anyone comment on whether there are:</p>
  
  <ul>
  <li>fundamental flaws in the above approach?</li>
  <li>any possible solutions for such flaws?</li>
  <li>any better way to secure local storage when an html 5 application must function offline for long periods?</li>
  </ul>
  
  <p>Thanks for any help.</p>