Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #35323

Re: Submitting *encrypted* forms via AJAX

Show key headers only | View raw

Julio Di Egidio <julio@diegidio.name> writes:

> On Wednesday, 27 June 2018 17:00:13 UTC+2, Ben Bacarisse  wrote:
>> "Christoph M. Becker" <cmbecker69@arcor.de> writes:
>> > On 27.06.2018 at 15:29, Jon Ribbens wrote:
>> >> On 2018-06-27, Thomas 'PointedEars' Lahn <PointedEars@web.de> wrote:
>> >>> Richard Damon wrote:
>> >>>
>> >>>> You provide the attacker with no more information than they have when
>> >>>> you use TLS, as the encryption algorithm is just as know.
>> >>>
>> >>> Incorrect; read again.
>> >>>
>> >>> To use an example that you should be able to understand: Encryption by 
>> >>> client-scripting that is like locking the door of my house, and pin a post-
>> >>> it note to the door that says “@Burglar: The key is below the mat.”, where 
>> >>> the key actually is.
>> >> 
>> >> You should look into this newfangled thing called "asymmetric encryption".
>> >
>> > I'm afraid we're way off topic for c.l.js.  However, as I see it, you'd
>> > have to deliver the *private* key to the client, which may not be the
>> > best idea, anyway.
>> 
>> It's perfectly possible to do authentication over an insecure connection
>> by running cryptographic code in the client.  Maybe Thomas Lahn has some
>> narrow meaning in mind for his words, but if so he's not saying.
>
> But the code on the client can be read by anyone, you just won't have any mean
> to secure it: and it's not so much the algo per se, it's the keys and
> similar.

The visibility of the algorithms and the other data does not prevent
client authentication.  Authentication over clear-text channels has been
done for decades.  How do you think TLS "bootstraps" the security in the
first place?

Anyway, this should not detract from the good advice to use HTTPS.  The
main problem of not using a secure connection that the user is
vulnerable to simple social engineering where an interloper replaces the
page with one that looks like the login page but POSTs the form, in the
clear, to wherever they like.

It does not matter that it's technically possible to make the
authentication safe because most users have no way of knowing that it's
safe.  You or I can have a look at the page source and see what's going
to happen when I click 'log in', but most people have to rely on the
feedback from the browser.  Users need to get used to the idea that all
log-ins (indeed, if possible, all web traffic) should be over HTTPS.

> Can't you guys just do things by the book, start by learning from the expert,
> instead of bullshitting your way around this world?

As it happens, I am an expert in this area (all-be-it a very minor one).

-- 
Ben.

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Submitting *encrypted* forms via AJAX bit-naughty@hotmail.com - 2018-06-25 02:48 -0700
  Re: Submitting *encrypted* forms via AJAX JJ <jj4public@vfemail.net> - 2018-06-25 22:03 +0700
    Re: Submitting *encrypted* forms via AJAX "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-06-25 17:21 +0200
      Re: Submitting *encrypted* forms via AJAX JJ <jj4public@vfemail.net> - 2018-06-26 14:59 +0700
        Re: Submitting *encrypted* forms via AJAX Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-26 16:47 +0200
          Re: Submitting *encrypted* forms via AJAX Richard Damon <Richard@Damon-Family.org> - 2018-06-26 21:09 -0400
            Re: Submitting *encrypted* forms via AJAX Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-27 09:45 +0200
              Re: Submitting *encrypted* forms via AJAX "Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid> - 2018-06-27 00:54 -0700
              Re: Submitting *encrypted* forms via AJAX Jon Ribbens <jon+usenet@unequivocal.eu> - 2018-06-27 13:29 +0000
                Re: Submitting *encrypted* forms via AJAX "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-06-27 15:47 +0200
                Re: Submitting *encrypted* forms via AJAX Ben Bacarisse <ben.usenet@bsb.me.uk> - 2018-06-27 16:00 +0100
                Re: Submitting *encrypted* forms via AJAX Julio Di Egidio <julio@diegidio.name> - 2018-06-27 08:11 -0700
                Re: Submitting *encrypted* forms via AJAX Ben Bacarisse <ben.usenet@bsb.me.uk> - 2018-06-28 01:53 +0100
                Re: Submitting *encrypted* forms via AJAX Julio Di Egidio <julio@diegidio.name> - 2018-06-27 21:48 -0700
                Re: Submitting *encrypted* forms via AJAX Jon Ribbens <jon+usenet@unequivocal.eu> - 2018-06-28 09:17 +0000
                Re: Submitting *encrypted* forms via AJAX Julio Di Egidio <julio@diegidio.name> - 2018-06-28 03:25 -0700
                Re: Submitting *encrypted* forms via AJAX "Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid> - 2018-06-27 14:04 -0700
                Re: Submitting *encrypted* forms via AJAX "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-06-28 13:54 +0200
                Re: Submitting *encrypted* forms via AJAX "Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid> - 2018-06-28 13:46 -0700
  Re: Submitting *encrypted* forms via AJAX jecxjo <jeff@sh0.xyz> - 2018-07-02 03:21 +0000
    Re: Submitting *encrypted* forms via AJAX Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-07-15 04:56 +0200
      Re: Submitting *encrypted* forms via AJAX "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2018-07-16 01:00 +0200

csiph-web