66 reputation
2
bio website antineutral.com
location
age
visits member for 1 year, 10 months
seen Dec 22 '12 at 10:25

Dec
21
comment How secure is aSSL (javascript)? Does it effectively mimic SSL?
I was thinking instead of a "hash" in typical sense, the server opens a session, assigns a GUID, gets referrer info (ensure it is from the same domain), Client IP, URL info, etc, and then encrypts that with AES server side (with random key that is stored onthe server). The server then sends the hash to the page, which posts it back to the server, which verifies the info by decrypting it. Then the pipeline opens. It then AES encrypts the GUID, stores it in the open conn database, and expires serverside it after either page is submitted, or 30 mins pass. Would this HELP mitigate MiTM?
Dec
20
awarded  Nice Question
Nov
30
comment How secure is aSSL (javascript)? Does it effectively mimic SSL?
Okay -- the main issue with all of this seems to MITM. Any ideas on how to mitigate this issue?
Nov
28
comment How secure is aSSL (javascript)? Does it effectively mimic SSL?
Yes, but what about something you can just add into web apps? Login for CMS systems, etc? Add a line of code that includes JS to search through the DOM, pluck the form fields, and have a go at it. All it takes is a few php files and a few JS files. It needs work on the MiTM issue, but it isn't useless.
Nov
28
comment How secure is aSSL (javascript)? Does it effectively mimic SSL?
Huge if question.. what if PRE handshake, a hash would be sent to the server, which would include request info that the backend would match against the hash. If the request is not coming from the domain it is registered to, it throws an error. THEN comes the public key. Once the handshake is completed, a token is generated and validated for each connection. Surely, SURELY, somebody can figure out how to mitigate the MiTM issue. JS PRNG entrophy is just a lost cause -- but if you could attain reasonable security without fussing with SSL, it would be interesting.
Nov
28
comment How secure is aSSL (javascript)? Does it effectively mimic SSL?
Per MiTM, could passing a hashed/salted session variable mitigate MiTM? As in, when starting the handshake a request the origin url ip and time, hash that with JS and match it to a "certificate" file on the server that would be able to verify this. We already know the domain, and we know where the request came from. Use this to set a session token that should be passed throughout the entire process. Thoughts?
Nov
27
comment How secure is aSSL (javascript)? Does it effectively mimic SSL?
I am well aware that JS based cryptography is weak to say the least. I'm well aware of the MiTM possibilities, of which I have an idea for (think a hashed/salted guid (kinda) for each step to prevent this -- salt generated via "post" char output). I know that JS creates crap PRNG, and clearly this is only suitable for minorly-critical data. The kind you would be comfortable using RC4 with. If MiTM could be mitigated (to a decent extent), would this be feasible? And to answer the SSL question -- YES, SSL is 100x better, but not available to all. I'm looking for middle ground here.
Nov
23
awarded  Student
Nov
23
asked How secure is aSSL (javascript)? Does it effectively mimic SSL?