Ho bloccato gli attacchi xss e l'estrazione della chiave API nel browser modificando monkey-patch crypto.subtle. Perché non lo fa nessun altro?

Ho bloccato gli attacchi xss e l'estrazione della chiave API nel browser modificando monkey-patch crypto.subtle. Perché non lo fa nessun altro? Here is how I hardened the browser runtime for a Zero-Knowledge, Non-Custodial FinTech trading terminal. 👇 2/ Client-Side Envelope Encryption: I derive a KEK from the user's password using PBKDF2-SHA256 (310,000 iterations). Then, a secure random 32-byte DEK (AES-256-GCM) encrypts the data. The password NEVER touches the server, and the DEK has a strict 15-min TTL in RAM before a wipe. 3/ Secure Enclave Anti-Export Guard: CryptoKeys are generated via crypto.subtle with {extractable: false}. To prevent injected malicious scripts from bypassing the sandbox, I implemented an isolated closure that overrides (monkey-patches) the native browser API: 4/ crypto.subtle.exportKey = async function(format, key) { if (isProtectedKey(key)) { _AuditChain.append('EXPORT_ATTEMPT', 'CRITICAL'); throw new Error('Export BLOCKED — unauthorized'); } return _origExport(format, key); }; 5/ If our database is breached, hackers find ZERO financial data. If the local session is compromised, runtime gating blocks extraction. Plus, client-side validation rejects API keys with withdrawal permissions enabled (zero custodial risk under MiCA, built for GDPR). 6/ The entire architecture runs client-side (WebSocket throttled at 100ms + local AI Advisor), keeping server costs near zero. Where does this runtime isolation logic fail? Why do major SaaS platforms still rely on standard local storage? Let's discuss. 💬 submitted by /u/Fit-Document9226 [link] [留言]