Linked Questions

18 votes
1 answer

CRM with Client Side Encryption

The company I'm working in wants to develop a CRM that is cloud-based and we will need to store the data safely. I've been searching for a way to create a strategy to save and secure data but I don't ...
Wilson Silva's user avatar
42 votes
2 answers

Why is there no web client for Signal?

I’ve read about E2EE (end to end encryption) of Signal in web clients on a Signal Community discussion forum, and wonder why they say that the browser is insecure for E2EE and native apps are secure. ...
SeyyedKhandon's user avatar
11 votes
5 answers

How To Prove That Client Side Javascript Is Secure?

Imagine that you have a web application that encrypts the user's data, such as a note or spreadsheet, on both the server and client. The normal process for a user using this web application is ...
Joseph's user avatar
  • 215
22 votes
3 answers

What’s wrong with in-browser cryptography in 2017?

There are many articles in the internet criticising JavaScript cryptography in the browser: "What’s wrong with in-browser cryptography?" by Tony Arcieri "Final post on Javascript crypto" on rdist "...
user1204395's user avatar
4 votes
2 answers

Can protonmail access my passwords and hence my secrets?

protonmail provides encrypted "zero-access" encryption mailboxes. The way they explain "zero-access" is, at least for me, similar to zero-knowledge encryption. However protonmail has in its servers my ...
JuanPi's user avatar
  • 143
5 votes
3 answers

How to best use JavaScript to encrypt client side so the server never sees it?

I don't want the server to ever see the raw input and would rather have the client do the encryption and then pass the data (over https) to the server for storage. If I use a JS library to AES ...
Ryan Detzel's user avatar
5 votes
3 answers

End to end encryption on top of HTTPS/TLS

I need to create a PHP Web application which stores some user entered data. These data should only be readable to some selective users of the system (including the user who created it).The data should ...
Kiran Muralee's user avatar
9 votes
1 answer

Problems with in Browser Crypto

There are lots of older articles1 on why in-browser crypto is a bad idea. Most are summed up via: We believe that SJCL provides the best security which is ...
erik's user avatar
  • 193
4 votes
2 answers

Web-based secret manager using CryptoJS

I'm building an application, part of which will allow businesses to store secrets. I'm looking at using CryptoJS ( This would encrypt everything on the client ...
vue-coder's user avatar
  • 143
3 votes
3 answers

To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?

I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
Shreck Ye's user avatar
  • 141
3 votes
2 answers

Questions on how works

I am reading's white paper, and two questions arise. Use of the asymmetric key. The white paper states the following. However, I am confused why the asymmetric key is necessary and how it ...
Tom Bennett's user avatar
1 vote
3 answers

1Password security weakness?

I was considering creating a 1Password families account because I liked the idea that 1Password never has the information needed to decrypt my passwords; however, when I created an account, I entered ...
g491's user avatar
  • 143
0 votes
2 answers

index.html integrity

Is it possible to make browsers verify that index.html matches some checksum? Context: With subresource integrity, you can specify SHA hashes for URLs, so that you know that you are getting the ...
Max Murphy's user avatar
1 vote
2 answers

Subresource integrity for same-origin (first-party) resources

Almost all of the articles I read about subresource integrity cover loading scripts (and CSS) from CDNs and third-party resources, which makes sense. Is there any value in adding the integrity ...
rink.attendant.6's user avatar
4 votes
1 answer

How to validate client side safety in a Zero Knowlegde model

What is sometimes called Zero Knowledge, sometimes end to end encryption occurs when a server only processes ciphered data (at least for sensitive data) with a result where a compromise of this server ...
Sibwara's user avatar
  • 1,328

15 30 50 per page