0

I've got a website and I would like the users to be able to login securely but I don't want to spend any money on SSL / certificates and I would like to stay anonymous i.e. not give the certificates people my personal details.

I've been reading around on some ways to do this, the best solution i've found is using a javascript library called jCryption that encrypts between client and server, but the encryption is in the hands of the users then.

The reason why I'm doing this cheap is because a) to get proper SSL you need the certificate, a static IP and an upgraded server account ... all of which cost money and b) because not many people will be logging in and c) the data isn't really 'top secret' stuff, I just don't want password flying through the internet in plaintext.

Is it feasible to encrypt html login forms between the client and server? If I did do this would the data be reasonably safe or could any script kiddy break it?

Improve this question
6
  • You've never needed a static IP to support SSL. If you don't need to support Internet Explorer 6 on Windows XP, a non-shared IP isn't needed either, as virtually everything else supports SNI.
    – Mark
    Nov 23, 2014 at 1:41
  • Hostgator seems to demand a static IP, I don't think it'll let me do it without
    – Crizly
    Nov 23, 2014 at 1:57
  • Can you give the users your server's key fingerprint in some other way?
    – user49075
    Nov 23, 2014 at 7:37
  • there are providers out there that offer free SSL certs. They require personal details of the registrant though. If you can convince your users that you're worried about the connection being encrypted more than it being transmitted to the correct end-point(MITM still possible), you could use a self-signed SSL cert to establish the connection.
    – Loopo
    Nov 23, 2014 at 9:54
  • maybe also take a look at sqrl
    – Loopo
    Nov 23, 2014 at 10:06

2 Answers 2

Reset to default
4

What you want is not possible, because there is no established trust relation between client and server and plain HTTP can not provide a secure way to establish this trust. Only HTTPS provides thus trust by checking the servers certificate against local trust anchors at the client, that is it infers the new trust from trust settings already built into the browser.

Without such trust between client and server you are open to man-in-the-middle attacks, where the attacker claims to be the server against the client and claims to be the client against the original server. In this case the encryption will be done between your client and the attacker, which then can decrypt the data, manipulate the data and forward the data encrypted to the real server. Such man-in-the-middle attacks are easily done in lot of networks (like public WLAN and most smaller LANs too).

While you might try to use a pre-shared secret to use instead of certificates it has the same problem: the secret somehow needs transferred between client and server and as long as this connection is open to manipulation (plain HTTP) the attacker can get and manipulate the shared secret. Even anonymous key exchange methods like Diffie-Hellman can not protect against this.

Improve this answer
1
  • Thanks, guess i'll just disable the login for now until i can fork over the cash :p
    – Crizly
    Nov 23, 2014 at 13:56
2

Since money is the issue for you, I'll post this link:

https://letsencrypt.org/2014/11/18/announcing-lets-encrypt.html

The EFF, Mozilla, and other organizations have teamed up to create a free CA. It's designed for people in your exact situation. The downside is that it will not be available until Q2 2015.

Improve this answer
1
  • Oo, i'll have to keep an eye out for that, looks good
    – Crizly
    Nov 24, 2014 at 20:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .