title: Blazor Wasm Data Protection
body: <p>Wondering if anyone's got a novel solution to this challenge.  Barring any browser-specific hack, or XSS attack, I believe encrypted data in memory and in LocalStorage is safe from everything but extensions.  Please correct me if I'm wrong.</p>
  <p>This brings us to malicious browser extensions that have unfettered access to both LocalStorage and possibly memory.</p>
  <p>Defenses:</p>
  <p>LocalStorage - I would think a layer of encryption that requires a short-lived memory-resident password from the user to decrypt.  Any other suggestions or insights would be most welcome.</p>
  <p>Memory - This is the question I'm most interested in.  Can a malicious browser extension probe Blazor's memory (akin to a DOM scan)?  Or is Blazor a separate untouchable region and the chrome extensions only have access to the Interop Javascript?  I know I suggested keeping data encrypted in memory as well, mostly to deter pagefile leaks, but there will be moments when blazor legitimately needs to decrypt/use that data in memory, and that's where I'm wondering if a malicious browser extension can get ahold of it.</p>