Can Encryption Keys Be Stored In A User's Google Account When Using Firebase Auth?
I have an app running on Firebase web, with Realtime Database, and Auth with Google as the sole auth provider. I want data to be readable only by the user, so while I understand Realtime Database provides secure transmission and server storage, I don't want myself to be able to look at user's information as well in my Firebase console.
End-to-end encryption storing keys on the user device is not an ideal solution, since I want users to be able to access data across multiple devices.
AES encryption seems to be the best solution, but then the usual problem arises of where to store the keys.
My theory
If each user has a separate encryption key for their data, and I could store it in some 'web app data' part of their account, I could store their key (encrypted) on their account. My app and server therefore does not store their key, and the user does not need to explicitly store or remember anything, and yet the key remains solely in their possession (via their possession of their Google account). I would be responsible for storing the key to decrypt their key for my database though.
My question
Though I understand asking for an analysis of this theory is not strictly programming related and is a somewhat open-ended question, I would at least like to get a sense of the feasibility of this solution, and whether it is possible programming-wise.
Thank you!
Answer
It appears Google Drive App Data offers a potential solution making this a feasible method. https://developers.google.com/drive/api/v3/appdata
By requesting a https://www.googleapis.com/auth/drive.appdata
scope during OAuth, an app can create an app data folder inside the user's Google Drive. An encryption key for user data seems like it can be stored in there then, without it being visible / tampered by the user, just in their possession at least.
Related Questions
- → How can I query Firebase for an equalTo boolean parameter?
- → How can I access nested data in Firebase with React?
- → Firebase simple blog (confused with security rules)
- → Removing item in Firebase with React, re-render returns item undefined
- → AngularJS Unknown Provider Error (Firebase & AngularFire)
- → How do you pass top level component state down to Routes using react-router?
- → "this" is null in firebase query function in reactjs
- → Angular Module Failed to Load
- → Multiple dex files define Lcom/google/android/gms/internal/zzrx;
- → Joining Firebase tables in React
- → How can I make add firepad to my reactjs project?
- → How to use Cloud Functions for Firebase to prerender pages for SEO?
- → React.js component has null state?