Web application may encrypt all user data at client side to convince users that it can't decrypt them.
When user enters password, it's used to encrypt data in browser and then it's sent to server in encrypted state. Server doesn't know password, encryption key and thus can't decrypt it.
But most of the users aren't able to review code used for encryption. All they can do is to trust it. Client side encryption may give feeling of control but:
- Server can send one encryption code to one user and another one to the other
- Government organization may urge server-side company so that it will disable encryption for certain users
So is there any benefit in client side encryption from user point of view?
