Protection in the browser
What is this about?
In short: on devices that others also use, you can give Illumentis extra protection. Shared device mode locks the app when it is idle, encrypts the local cache and can hide the text while the tab is in the background. It protects against casual glances and quick access, not against every attacker.
Protection goal
Whoever gets hold of your unattended device should not be able to read your texts easily, not even from what is stored locally in the browser.
How it works
- Setting up: You choose a PIN or a password. The dialog shows how quickly a code could be guessed offline, because a longer code is much safer.
- Key: The key for the local storage is not stored but derived anew from your PIN or password in every session.
- Lock on inactivity: After a pause, the app saves your text, removes the editor interface and shows a lock screen. To unlock, you enter your PIN or password. After too many failed attempts, a waiting time applies.
- Privacy shield: While the tab is in the background, the text is removed from the display. It is not just drawn blurred, because text that stays in the page structure would only seem protected.
Measures
- We encrypt the local cache with a key that is not stored, so that a copied cache cannot be read without the PIN.
- When locking, we remove the whole editor interface rather than just emptying it, so that no references to the old text stay behind.
- We save before locking, so that locking does not lose any text.
- We slow down failed attempts to unlock.
- Browser policies (Content Security Policy) reduce the risk of injected scripts reading the page.
What we do not promise
- A short PIN protects against quick access, but not against someone who copies the local storage and tries at leisure. A longer password helps against that.
- A browser does not allow secure erasure of memory. Traces of it can remain.
- The privacy shield does not help against a second screen or a glance over your shoulder while the tab is visible.
- The operating system’s swap file lies outside the browser. The mode does not replace encryption of your device’s disk.
- On an unlocked device, anyone sees what is on the screen.
How we check this
The protection has automated tests, which the table below names. The mode is optional and meant for devices you share with others.
Evidence tests
| Test | What the test proves |
|---|---|
schutzschirmCrypto.test.js |
The local cache is encrypted with a key derived from the PIN. |
schutzschirmStore.test.js |
Setting up, locking and unlocking shared device mode behave as intended. |
schutzschirmAppLockUnmount.test.js |
When locking, the editor interface is removed and not only emptied. |
visibilityShield.test.js |
The text is removed from the display while the tab is in the background. |
chapterEditorAutoLockSaveFailure.test.js |
A failed save during automatic locking is handled. |
Change history
- : First version.