Important to know

  • Will not be passing the DEK from client to the server

  • The DEK will be used to encrypt all the data being placed within a github repository, it is possible that cipher-text will be available publicly because of the use of public repositories

  • the encryption and hashing will be done on the client-side


  • Other than MITM attacks or somebody with access to the client machine what should I foresee?

  • Should I use a key other than the pass to generate the hash to remove single point of failure?

  • Any other suggestions?

  • Encryption of the data is not the biggest worry especially if users have private repos, but there is a concern for public repos, is there another way I could go about this?


I ended up using another key as I do not want to make the password vulnerable in the case of a brute force attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.