Linked Questions
26 questions linked to/from Solution to the ‘Browser Crypto Chicken-and-Egg Problem’?
18
votes
1
answer
3k
views
CRM with Client Side Encryption
The company I'm working in wants to develop a CRM that is cloud-based and we will need to store the data safely.
I've been searching for a way to create a strategy to save and secure data but I don't ...
- 291
42
votes
2
answers
32k
views
Why is there no web client for Signal?
I’ve read about E2EE (end to end encryption) of Signal in web clients on a Signal Community discussion forum, and wonder why they say that the browser is insecure for E2EE and native apps are secure.
...
- 537
11
votes
5
answers
9k
views
How To Prove That Client Side Javascript Is Secure?
Imagine that you have a web application that encrypts the user's data, such as a note or spreadsheet, on both the server and client.
The normal process for a user using this web application is ...
- 215
22
votes
3
answers
5k
views
What’s wrong with in-browser cryptography in 2017?
There are many articles in the internet criticising JavaScript cryptography in the browser:
"What’s wrong with in-browser cryptography?" by Tony Arcieri
"Final post on Javascript crypto" on rdist
"...
- 223
4
votes
2
answers
1k
views
Can protonmail access my passwords and hence my secrets?
protonmail provides encrypted "zero-access" encryption mailboxes.
The way they explain "zero-access" is, at least for me, similar to zero-knowledge encryption.
However protonmail has in its servers my ...
- 143
5
votes
3
answers
25k
views
How to best use JavaScript to encrypt client side so the server never sees it?
I don't want the server to ever see the raw input and would rather have the client do the encryption and then pass the data (over https) to the server for storage.
If I use a JS library to AES ...
- 161
5
votes
3
answers
4k
views
End to end encryption on top of HTTPS/TLS
I need to create a PHP Web application which stores some user entered data. These data should only be readable to some selective users of the system (including the user who created it).The data should ...
- 151
9
votes
1
answer
2k
views
Problems with in Browser Crypto
There are lots of older articles1 on why in-browser crypto is a bad idea. Most are summed up via: http://bitwiseshiftleft.github.io/sjcl/
We believe that SJCL provides the best security which is ...
- 193
4
votes
2
answers
1k
views
Web-based secret manager using CryptoJS
I'm building an application, part of which will allow businesses to store secrets.
I'm looking at using CryptoJS (https://www.npmjs.com/package/crypto-js). This would encrypt everything on the client ...
- 143
3
votes
3
answers
1k
views
To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?
I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
- 141
3
votes
2
answers
722
views
Questions on how sync.com works
I am reading sync.com's white paper, and two questions arise.
Use of the asymmetric key.
The white paper states the following. However, I am confused why the asymmetric key is necessary and how it ...
- 142
1
vote
3
answers
491
views
1Password security weakness?
I was considering creating a 1Password families account because I liked the idea that 1Password never has the information needed to decrypt my passwords; however, when I created an account, I entered ...
- 143
0
votes
2
answers
508
views
index.html integrity
Is it possible to make browsers verify that index.html matches some checksum?
Context:
With subresource integrity, you can specify SHA hashes for URLs, so that you know that you are getting the ...
- 245
1
vote
2
answers
779
views
Subresource integrity for same-origin (first-party) resources
Almost all of the articles I read about subresource integrity cover loading scripts (and CSS) from CDNs and third-party resources, which makes sense.
Is there any value in adding the integrity ...
- 2,257
4
votes
1
answer
332
views
How to validate client side safety in a Zero Knowlegde model
What is sometimes called Zero Knowledge, sometimes end to end encryption occurs when a server only processes ciphered data (at least for sensitive data) with a result where a compromise of this server ...
- 1,328