I want to code a web app that allows 2 users to send encrypted messages to each other, and I want to maximize security, so I want to minimize the amount of trust I put in my cloud provider (both the database and the server where the app code is).
If I assume that cryptography experts' warnings about JS are correct, I have these questions:
- Is it at all possible to develop an app like I envisioned (end-to-end encryption from client to client) without me needing to learn to code Android or iOS? (If not, then what approach gets me closest to my goal?)
I also want convenience: I want the users to be able to log into the website from any device as long as they also can provide a multi-factor auth code from their phone.
(I.e. Using the app can't require localStorage specific to one device or require uploading files of keys that are too long to memorize; users need to be able to log in just by providing credentials they've memorized.)
I'm hoping someone kind will point me in the right direction instead of just dismissing my questions with the typical "If you have to ask about security, you should leave it to the pros." I want to learn. Thanks.