Adding ability to encrypt storage data

Do you have near term plans to incorporate encryption onto the storage data? https://github.com/jas-/crypt.io

In this case, we could pass an additional attribute in the persistConfig to persist the data with encryption (The flag could either be the machine’s UUID or a user set passphrase)

var pass = window.prompt("Please enter password...", "a custom password");

var persistConfig = {
  passphrase: pass
};

persistStore(store, config, callback);

[robmoorman]

I’ve implemented the idea @rt2zz earlier and it’s working quite well (it passes security audits). For iOS we use a passphrase stored in the KeyChain on Android on KeyStore. With that passphrase we encrypt/decrypt data via redux-persist.

Two things to keep in mind

• crypto-js is slow, especially with huge data sets stored on device, a off js thread will be cool to have
• lock/reboot iOS locks the keychain, you need to adjust settings to make the keychain available on any time (otherwise your app won’t be able to decrypt the data on the background (e.g. via a geofence event or background-fetch execution time process)

Planning to make this mechanism open-source, as it’s battle tested for some months now in different production apps.

[robmoorman]

Hi @rt2zz it’s an addition to https://github.com/maxdeviant/redux-persist-transform-encrypt as the secretKey comes from the KeyChain/KeyStore (auto-generated by the device), so it’s not stored in the JS bundle on device.

There is a setting for iOS, yes. To adjust that the keychain can be accessed in this case. I used this, but you can see what the settings is like: https://github.com/oblador/react-native-keychain/blob/master/RNKeychainManager/RNKeychainManager.m#L85

More info here: https://developer.apple.com/reference/security/ksecattraccessiblealways

I’ll inform you when this package is ready (need it for a project right now, so planning to make it open-source).