title: HTML5 offline authentication
body: <p>I am looking for advice/criticism on how best to control access to an HTML5 application that is used predominantly offline.</p>
  
  <p>The application uses a combination of IndexedDB, local and session storage to store data so that it can be used offline. The data/pages are served via HTTPS.</p>
  
  <p>The aim is to minimise the risk of the data being viewed if the tablet/PC was lost/stolen. </p>
  
  <p>Currently the application uses the Stanford Javascript Crypto library to encrypt the user/password and then save it to local storage if the user is able to successfully authenticate to the server. If the application then goes offline a user must authenticate 'locally' against the encrypted user/password in local storage.</p>
  
  <p>In addition an unencrypted user/password is stored in the session storage if the user is able to successfully authenticate to the server. This is used so that the application can periodically attempt to re-establish contact with the server and 'seemlessly' re-authenticate without requiring the user to re-enter their credentials.</p>
  
  <p>I am aware of a number of posts/discussions about the fallibility of client side encryption refer <a href="http://www.matasano.com/articles/javascript-cryptography/">http://www.matasano.com/articles/javascript-cryptography/</a> and <a href="http://rdist.root.org/2010/11/29/final-post-on-javascript-crypto/">http://rdist.root.org/2010/11/29/final-post-on-javascript-crypto/</a> and .nczonline.net/blog/2010/04/13/towards-more-secure-client-side-data-storage/ + others. However I am unsure how these arguments apply in this scenario.</p>
  
  <p>I am looking for criticism of the approach given the need of storing data offline. If there is a better approach please elaborate. </p>
  
  <p>Thanks</p>