1

I have an websocket connection without SSL certificate (just plain WS, not WSS).

Every message is transferred as JSON (text).

What might be best way to secure communication? Which encryption algorithm should I use?

  • Most important is to secure integrity of messages, but hiding sent content would be also benefit

I was thinking that user might have it's secret like password It cannot be transferred through wire, as it would be visible on network, but instead it might be private key for connection.

2

The best way to secure communication is to get an SSL certificate. Anything else means you're just re-implementing SSL, probably in an insecure fashion.

Specifically, anything you do to secure the data will need to be done in JavaScript. That JavaScript needs to be transmitted over the Internet, so either it's protected by SSL (meaning you've got a certificate you can apply to your websocket connection), or it's not protected and an attacker can tamper with it, rendering any security it applies to the websocket meaningless.

  • You are right... but there may be case you cannot use WSS, but you can use JavaScript from secured/https source. – Jurosh Jun 16 '17 at 20:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.