Search code examples
securitywindows-8windows-store-apps

Windows 8 Apps - Local Storage Security


How secure is the local data

ApplicationData.Current.LocalSettings

storage used in Windows 8 Store Apps?

This application data storage article says nothing about security, neither does this one.

Can this data be manipulated from outside of the app?

I looked at the location of the data

C:\Users[username]\AppData\Local\Packages[package_namespace]\LocalState)

but did not find it. Where is it saved exactly?

I'm trying to asses the security of this storage mechanism to decide whether I can store security-critical information there.


Solution

  • After some more investigation I found:

    http://lunarfrog.com/blog/2012/09/13/inspect-app-settings/

    The data is stored in

    C:\Users[username]\AppData\Local\Packages[package_namespace]\LocalState\Settings\settings.dat

    which is a Windows NT registry file (REGF) which can be openend with the registry editor and can also be manipulated.

    Meaning, local storage is NOT safe.

    If there is no other way, encrypting the data and obfuscating the keys is a possibility.