Windows 8 Apps - Local Storage Security

问题:

How secure is the local data

ApplicationData.Current.LocalSettings

storage used in Windows 8 Store Apps?

This application data storage article says nothing about security, neither does this one.

Can this data be manipulated from outside of the app?

I looked at the location of the data

C:\Users[username]\AppData\Local\Packages[package_namespace]\LocalState)

but did not find it. Where is it saved exactly?

I'm trying to asses the security of this storage mechanism to decide whether I can store security-critical information there.

回答1:

After some more investigation I found:

http://lunarfrog.com/blog/2012/09/13/inspect-app-settings/

The data is stored in

C:\Users[username]\AppData\Local\Packages[package_namespace]\LocalState\Settings\settings.dat

which is a Windows NT registry file (REGF) which can be openend with the registry editor and can also be manipulated.

Meaning, local storage is NOT safe.

If there is no other way, encrypting the data and obfuscating the keys is a possibility.

回答2:

If it's user credentials that you want to store, take a look at PasswordVault class. Otherwise use DPAPI as you already suggested yourself.

回答3:

This application data storage article says nothing about security, neither does this one. Can this data be manipulated from outside of the app?

That storage is similar to iOS's Core Data. Its essentially untrusted input unless storage is protected (below the application level). Even if the storage is protected with encryption, its likely not authenticated so its subject to tampering.

If there is no other way encrypting the data and obfuscating the keys is a possibility.

On Windows Platforms, the standard way to protect sensitive data is to use the Data Protection API (DPAPI). Use DPAPI with the user supplied secret (the additional entropy in the APIs) for the best protection. You store the DPAPI'd data with the user's profile, in the registry, or on the filesystem. See, for example, Windows Data Protection, How to: Use Data Protection, and Data protection API (Windows Store apps). Michael Howard and David LeBlanc have a good treatment of the subject in Writing Secure Code, Second Edition. See Chapter 9, Protecting Secret Data, beginning on page 299.

If you want database like encryption, look at SQLCipher. It uses authenticated encryption, so it provide confidentiality and integrity. Windows 8 supports native libraries, including on their phones (see, for example, Native code on Windows Phone 8).