0

I've got a website and I would like the users to be able to login securely but I don't want to spend any money on SSL / certificates and I would like to stay anonymous i.e. not give the certificates people my personal details.

I've been reading around on some ways to do this, the best solution i've found is using a javascript library called jCryption that encrypts between client and server, but the encryption is in the hands of the users then.

The reason why I'm doing this cheap is because a) to get proper SSL you need the certificate, a static IP and an upgraded server account ... all of which cost money and b) because not many people will be logging in and c) the data isn't really 'top secret' stuff, I just don't want password flying through the internet in plaintext.

Is it feasible to encrypt html login forms between the client and server? If I did do this would the data be reasonably safe or could any script kiddy break it?

  • You've never needed a static IP to support SSL. If you don't need to support Internet Explorer 6 on Windows XP, a non-shared IP isn't needed either, as virtually everything else supports SNI. – Mark Nov 23 '14 at 1:41
  • Hostgator seems to demand a static IP, I don't think it'll let me do it without – Crizly Nov 23 '14 at 1:57
  • Can you give the users your server's key fingerprint in some other way? – user49075 Nov 23 '14 at 7:37
  • there are providers out there that offer free SSL certs. They require personal details of the registrant though. If you can convince your users that you're worried about the connection being encrypted more than it being transmitted to the correct end-point(MITM still possible), you could use a self-signed SSL cert to establish the connection. – Loopo Nov 23 '14 at 9:54
  • maybe also take a look at sqrl – Loopo Nov 23 '14 at 10:06
4

What you want is not possible, because there is no established trust relation between client and server and plain HTTP can not provide a secure way to establish this trust. Only HTTPS provides thus trust by checking the servers certificate against local trust anchors at the client, that is it infers the new trust from trust settings already built into the browser.

Without such trust between client and server you are open to man-in-the-middle attacks, where the attacker claims to be the server against the client and claims to be the client against the original server. In this case the encryption will be done between your client and the attacker, which then can decrypt the data, manipulate the data and forward the data encrypted to the real server. Such man-in-the-middle attacks are easily done in lot of networks (like public WLAN and most smaller LANs too).

While you might try to use a pre-shared secret to use instead of certificates it has the same problem: the secret somehow needs transferred between client and server and as long as this connection is open to manipulation (plain HTTP) the attacker can get and manipulate the shared secret. Even anonymous key exchange methods like Diffie-Hellmann can not protect against this.

  • Thanks, guess i'll just disable the login for now until i can fork over the cash :p – Crizly Nov 23 '14 at 13:56
1

Since money is the issue for you, I'll post this link:

https://letsencrypt.org/2014/11/18/announcing-lets-encrypt.html

The EFF, Mozilla, and other organizations have teamed up to create a free CA. It's designed for people in your exact situation. The downside is that it will not be available until Q2 2015.

  • Oo, i'll have to keep an eye out for that, looks good – Crizly Nov 24 '14 at 20:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.