HTML5 Web Database Security

Should the HTML5 database be used to store any form of private information?

Say we have the following scenario;

You're browsing a web-mail client, that uses the web database to store mail drafts after you've written some i开发者_如何转开发nformation you close the web browser. What's to stop me from getting access to this information?

If the webpage tries to clean out old information when opened a user-script could easily prevent the website from fully loading and then search through the database. Furthermore the names of databases and tables are easily available through the web-mail client's source.

W3C Draft

---

The only way an external party could access the user's database is via direct access to the user's computer, or if your web app has a security vulnerability (such as XSS - Cross Site Scripting). Otherwise standard browser security dictates that only scripts running in web pages from a certain domain can access databases that were created/stored on that same domain (same origin-policy), same thing that stops you making cross-domain Ajax requests, or reading other website's cookies, all of which can be overcome via an XSS attack.

To me, storing a draft email seems reasonably sensible, whereas things like credit card details, passwords etc. should be stored exclusively server-side. You'll need to make a call as to what should be stored where, based on what you're going to store.

---

Should the HTML5 database be used to store any kind of private information?

Depends on how sensitive the information is. I wouldn't want to leave credit card details lying around anywhere.

You're browsing a web-mail client, that uses the web database to store mail drafts after you've written some information you close the web browser. What's to stop me to get access to this information?

Assuming you don't have physical access to the computer (in which case the user needs to take relatively extreme security measures) and you don't run the email service (in which case you need to have access to emails) then standard browser security stops you.