Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 7 down vote favorite
1

I understand that sending data from the user to the server, unencrypted, is a bad practice. That is logical.

So how do I encrypt 'userside' and send the data to the server in encrypted form?

Can anyone suggest a good practice example?

What are the advantages and disadvantages of encrypting in Javascript? (What if the user has disabled Javascript?)

share|improve this question
7  
If you are encrypting using Javascript a user could easily reverse engineer your application and discover the key. The best solution is to just use HTTPS – Rell3oT Dec 18 '12 at 20:48
1  
matasano.com/articles/javascript-cryptography discusses in detail why using JavaScript for cryptography is a bad idea. And kudos for recognizing that JS should be a choice that is not forced on the user of the app. – Jonathan Garber Dec 18 '12 at 21:06
Tnx for the answer, u confirmed why not to use JavaScript. So besides using https is there any other option for doing this? – MrNewbProgrammer Dec 18 '12 at 21:15
Btw, tnx for the matasano article, very good reading – MrNewbProgrammer Dec 18 '12 at 21:32

2 Answers

up vote 6 down vote accepted

The standard solution is to use SSL (HTTPS).

Please spend some time with the search tool on this site. You will find these questions have all been answered on other questions, so you can find lots of good information. For instance, a search on "Javascript encryption" will find a lot of information about the pitfalls of encrypting on the client-side in Javascript.

Make sure to learn about how to enable SSL sitewide; about HSTS; and about the secure flag on cookies.

In general, I recommend OWASP as an excellent resource with a lot of information about good practices for securing web services.

share|improve this answer
Tnx. I will check that out. – MrNewbProgrammer Dec 19 '12 at 0:48
up vote 0 down vote

other than confidentiality, https solves a lot of other problems. There is no safe way to send passwords in the clear or encoded or obfuscated somehow. Https really is the best solution.

share|improve this answer
1  
Ok, yeah i was just asking for other posibilities, because ssl is an expensive venture. Luckily for me im not building and application which has any really harmful options for users (what i mean its not a banking or buying or anything uf that sorts) I still want to make it as secure as possible given the financial restrictions. So thank your for the answer :D – MrNewbProgrammer Dec 18 '12 at 22:31
You don't have to purchase a SSL cert - try someone like cacert.org or search 'free ssl certificates" or just generate a self-signed cert if you are just in the testing phase. – Ryan Griggs Dec 19 '12 at 4:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.