I am planning to create a private web site where people of a very specific target group would keep private stuff.

I am between two major roads for this.

Road 1

-Build a trusting and personal relationship with the members. Above this apply htts sitewide and create a strong privacy agreement.

Road 2

-Implement client side encryption with keys that only the user will know and have the responsibility to maintain.

To give a similar example think of that: Keeping a daily journal on the web. Either i would sent my text already encrypted or i would rely on the privacy of the site.

1 Answer 1


The two are not mutually exclusive. You can build a close, trusted community in addition to using cryptography to help support it. Encryption would also help protect the information against an outside attacker. You also don't have to have the clients themselves maintain the keys, that isn't very useable, but you can have encryption keys protected with their passwords that are managed by the server to simplify use of the site without sacrificing much in the way of security.

  • It will be important for them to know that even i cannot read their texts in any way...that's why i think of letting them be responsible for their encryption key...
    – e4rthdog
    Commented Mar 6, 2013 at 20:29
  • Explaining your encryption scheme would still do this. As long as the encryption keys are protected by their password, you couldn't use them. Additionally, for stronger protection, you could use client side certificates (it's not done often, but would allow for stronger protection of server side data keys). The advantage to server side key storage is that it allows for easier usage of the site and easier sharing of information. Say for example User A wants to share something with User B. Without a server side store, they would have to work directly together. Commented Mar 6, 2013 at 20:32
  • @e4rthdog - with the server as a middle man however, User A could encrypt the data key with User B's public key and leave it for User B to be able to use. Only User B could access the key though, even if it was shared with everyone. Commented Mar 6, 2013 at 20:33
  • Where do you think i should start reading about the theory of your proposal? "you can have encryption keys protected with their passwords that are managed by the server"
    – e4rthdog
    Commented Mar 6, 2013 at 20:36
  • 1
    @e4rthdog - when the user log's in, the server unlocks their private key and can use that to decrypt the keys on their keyring. The keys on their keyring can then be used to access any information they have access to. Commented Mar 6, 2013 at 20:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .