Timeline for Should I encrypt sensitive form data with JavaScript on the client?
Current License: CC BY-SA 4.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 20, 2018 at 21:39 | vote | accept | user10103279 | ||
| Sep 20, 2018 at 20:04 | vote | accept | user10103279 | ||
| Sep 20, 2018 at 20:14 | |||||
| Sep 20, 2018 at 17:38 | history | edited | Anders | CC BY-SA 4.0 |
added 18 characters in body
|
| Sep 20, 2018 at 17:37 | comment | added | Anders | @JesseDanielMitchell Checked caniuse, and i'ts around 90% globally, mostly because of Opera Mini. Far better than I thought, Ill have to admit. | |
| Sep 20, 2018 at 16:20 | comment | added | Jesse Daniel Mitchell |
@Anders iirc, most modern browsers (post-2013) support window.crypto.getRandomValues which should allow decent key generation.
|
|
| Sep 20, 2018 at 14:55 | comment | added | Serverfrog | @Anders, That is true. I think that is also the reason no "true" WebApplication do that. As example, Whatsapp uses the MobilePhone to encrypt the messages and not the Web Frontend as far as i know. | |
| Sep 20, 2018 at 14:45 | comment | added | Anders | @Serverfrog And add to that many browsers can't generate secure random numbers, making key generation tricky. | |
| Sep 20, 2018 at 14:07 | comment | added | Serverfrog | @Ajedi32, That's true. It was just to call out that it isn't a "always Bad" idea to create a encryption on the client side. It is just a very specific problem one will try to solve (and that is done in the past is shown with all the Mobile Messenger we have today, but how trustworthy they are is another question to often asked here) | |
| Sep 20, 2018 at 14:05 | comment | added | Ajedi32 | @Serverfrog That's only true as long as the server cooperates. A malicious server could easily just serve some JS that tells the browser to send decrypted message data to the server. | |
| Sep 20, 2018 at 13:59 | comment | added | Serverfrog | One Thing that Client Encryption can do is to ensure that the Server can't know what the client was sending. Like Chat Messages where the Server isn't allowed to see what the Client was sending to Another Client. | |
| Sep 20, 2018 at 13:50 | history | answered | Anders | CC BY-SA 4.0 |