Javascript encryption
vincentcheung.ca
Javascript encryption
1–10 of 63 posts
Re: Javascript encryption
#2John Walker made that already at least 6 years ago:
http://www.fourmilab.ch/javascrypt/
Moreover, Walker's code is public domain and he discusses security aspect, whereas the op link appears not to care about such things.
Re: Javascript encryption
#3Could anyone explain what's the use case for encrypting text on a web page using JavaScript? I don't understand how this library is useful except for situation when used in Chrome extensions like the one used by LastPass.
If this lib is used on a page to decrypt/encrypt user data before sending to the server, theoretically it's possible for the host to steal private key simply by injecting a JS code that copies user's private key.
Re: Javascript encryption
#4Snakeoil
Re: Javascript encryption
#5Could anyone explain what's the use case for encrypting text on a web page using JavaScript? I don't understand how this library is useful except for situation when used in Chrome extensions like the one used by LastPass. If this lib is used on a page to decrypt/encrypt user data before sending to the server, theoretically it's possible for the host to steal private key simply by injecting a JS code that copies user'…
The first thought I had was to be able to store personal data on a server and have secure access from any web browser. Basically a simplified version of 1PasswordAnywhere (http://help.agilebits.com/1Password3/1passwordanywhere.html).
Update: I should probably note that I haven't looked at the implementation, and there's no way I'd do as I mention above without having complete control of sources.
Re: Javascript encryption
#6What does this offer over SJCL?
And for those asking in the thread, JS encryption is useful in that you never have to trust a server with your plaintext.
Re: Javascript encryption
#7What does this offer over SJCL? And for those asking in the thread, JS encryption is useful in that you never have to trust a server with your plaintext.
If you are running javascript on a page from a server, you are trusting the server with your plaintext.
Re: Javascript encryption
#8What does this offer over SJCL? And for those asking in the thread, JS encryption is useful in that you never have to trust a server with your plaintext.
If you are running javascript on a page from a server, you are trusting the server with your plaintext.
Seems like browser extensions would be the way to go.
Here's the SJCL demo: http://bitwiseshiftleft.github.com/sjcl/demo/
Re: Javascript encryption
#9Earlier quoted context omitted.
If you are running javascript on a page from a server, you are trusting the server with your plaintext.
Seems like browser extensions would be the way to go. Here's the SJCL demo: http://bitwiseshiftleft.github.com/sjcl/demo/
SJCL has a bug in their RSA implementation. We're using a good bit of their code with a few changes for our web client. The idea being that we don't want to store passwords, so the webclient stores an encrpyted private key and everything sent to the server must be signed.
The users id is a sha256 hash of their public key and all we keep are the public keys.
Working so far in FF and Chrome, not even trying it in IE
Re: Javascript encryption
#10Could anyone explain what's the use case for encrypting text on a web page using JavaScript? I don't understand how this library is useful except for situation when used in Chrome extensions like the one used by LastPass. If this lib is used on a page to decrypt/encrypt user data before sending to the server, theoretically it's possible for the host to steal private key simply by injecting a JS code that copies user'…
Maybe not encrypting text on a page, but possibly to encrypt JSON data to local storage for persistence.
Never do this with absolutely private data, but then again.