There are a lot of arguments around whether web applications can implement end to end encryption. Most of the arguments against javascript based solutions are centered around the fact that the the communication under consideration is between two parties which uses that web application as a channel for communication. (Example: Webmail - Protonmail, Chat Clients - Whatsapp Web, Telegram Web). The argument says that the server can always serve a malicious javascript and the communicating parties cannot trust that it would not happen.
The question I have is slightly different. The communicating parties here are the end user who accesses the web application on a browser and a final downstream server behind multiple components such as load balancers and WAFs. The threat here is that I do not trust any of the intermediate systems as TLS do get terminated at each of those endpoints.
- Is there any possible way I can achieve end to end encryption between the end user and the final backend server if the channel itself is not trusted?
I see potential opportunities for MITM in the key exchange even if we use DHE with signed public keys because the JS which is supposed to be performing the signature validation can be manipulated by one of the intermediary systems.
- Is there any other way to at least partial end to end encryption? [perhaps by segregating the involved systems or by adding detective controls]