Currently we have an email address and in certain cases we receive sensitive data via email. The goal is protecting this sensitive data. We have a website with SSL too so we thought that the website could encrypt these messages with a public key and send them to our email address, so we could decrypt the ciphertext locally with our private key. This way we would decrease our attack surface, because stealing the database and files from the webserver would not cause any data breach. Only modifying the webpage would cause an issue, which can be detected. Does this solution have any drawback compared to storing the messages encrypted on the server and downloading them from there via HTTPS?
4
-
2I presume when you say "encrypt them with a public key" you mean you're going to use a standard like PGP, rather than your own custom scheme? This stuff is quite tricky to get right, and even PGP isn't perfect, so if you're thinking of rolling your own then I'd strongly advise against it.– PolynomialCommented Oct 8, 2021 at 17:17
-
@Polynomial I wanted to use Javascript and encrypt it in the browser. After that I would send it in an email just as normal data or store it on the server temporarily. It does not have to be 100% fool proof, but I think in this case any kind of encryption is better than sending a massive amount of unencrypted personal data through email... As far as I understand asymmetric encryption is used for these kind of scenarios and it is not an issue if somebody can read the public key from the javascript code running in the browser.– inf3rnoCommented Oct 8, 2021 at 23:07
-
Using your custom encryption scheme, how would you view the email on the receiving end?– PolynomialCommented Oct 9, 2021 at 0:32
-
@Polynomial I can use PGP too: openpgpjs.org With a custom scheme I could write a desktop application for the email receiver, which uses a private key to decrypt the ciphertext of the incoming messages. If I have a strict message structure and don't support file sending, then it is relative easy to write a secure application. The usual way to protect the private key is using a passphrase with symmetric enryption on it. I like the idea of using an already written PGP desktop application and in the long run we want to send encrypted messages too, so PGP would be a better solution.– inf3rnoCommented Oct 9, 2021 at 21:21
Add a comment
|
1 Answer
I'm not an expert in web servers, but I think both approaches are better than just storing the data unencrypted on the web server. An approach with immediate sending the data without even storing it looks a bit better, as the attacker will have problems even accessing the cyphertext.
However, you have to remember that everything comes at a price, and in this case the price is that the message is effectively sent once; if, for example, your email server would be unavailable, or your mailbox would be full, the message is going to be lost forever. You need to either accept that risk, or implement some checks & message cache on the web server.
And one off-topic remark I would like to make: I do not agree with the phrase "Only modifying the webpage would cause an issue". Many web servers allow custom handlers that will run whenever any page is accessed. An attacker can modify web server logging configuration and dump the request contents. It can also be intercepted while sending to mail server etc. etc. So if you are very concerned by this host' security, monitoring just the web page would definitely not be enough.
