Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #35320

Re: Submitting *encrypted* forms via AJAX

Path csiph.com!eternal-september.org!feeder.eternal-september.org!reader02.eternal-september.org!.POSTED!not-for-mail
From Ben Bacarisse <ben.usenet@bsb.me.uk>
Newsgroups comp.lang.javascript
Subject Re: Submitting *encrypted* forms via AJAX
Date Wed, 27 Jun 2018 16:00:04 +0100
Organization A noiseless patient Spider
Lines 30
Message-ID <87zhzgp957.fsf@bsb.me.uk> (permalink)
References <075dc3b9-1b96-4bc9-9d88-a79ee815e8e2@googlegroups.com> <1ayv347oigack.t9kcyjsxesx9$.dlg@40tude.net> <pgr199$rfs$1@solani.org> <uvb47mtapk89.1jtol6uw3tk7p$.dlg@40tude.net> <5696879.fPQVyQoktA@PointedEars.de> <TsBYC.379957$br4.78508@fx34.iad> <3824731.5j0TqHaiX3@PointedEars.de> <slrnpj74af.3q5.jon+usenet@sable.unequivocal.eu> <ph04hb$63c$1@solani.org>
Mime-Version 1.0
Content-Type text/plain; charset=utf-8
Content-Transfer-Encoding 8bit
Injection-Info reader02.eternal-september.org; posting-host="2c488b9cf542482d9a9e534322905e52"; logging-data="21556"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19h30ZRTjjiRRPTP+1NYYX+wf4XzDJROqE="
Cancel-Lock sha1:qPtdsyLOntrbNPtO3gAcyVINvG0= sha1:0h+/lV8/odfTe6OpHZ18tgY4Lyw=
X-BSB-Auth 1.d3758a3fed5461424e78.20180627160004BST.87zhzgp957.fsf@bsb.me.uk
Xref csiph.com comp.lang.javascript:35320

Show key headers only | View raw

"Christoph M. Becker" <cmbecker69@arcor.de> writes:

> On 27.06.2018 at 15:29, Jon Ribbens wrote:
>
>> On 2018-06-27, Thomas 'PointedEars' Lahn <PointedEars@web.de> wrote:
>>
>>> Richard Damon wrote:
>>>
>>>> You provide the attacker with no more information than they have when
>>>> you use TLS, as the encryption algorithm is just as know.
>>>
>>> Incorrect; read again.
>>>
>>> To use an example that you should be able to understand: Encryption by 
>>> client-scripting that is like locking the door of my house, and pin a post-
>>> it note to the door that says “@Burglar: The key is below the mat.”, where 
>>> the key actually is.
>> 
>> You should look into this newfangled thing called "asymmetric encryption".
>
> I'm afraid we're way off topic for c.l.js.  However, as I see it, you'd
> have to deliver the *private* key to the client, which may not be the
> best idea, anyway.

It's perfectly possible to do authentication over an insecure connection
by running cryptographic code in the client.  Maybe Thomas Lahn has some
narrow meaning in mind for his words, but if so he's not saying.

-- 
Ben.

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Submitting *encrypted* forms via AJAX bit-naughty@hotmail.com - 2018-06-25 02:48 -0700
  Re: Submitting *encrypted* forms via AJAX JJ <jj4public@vfemail.net> - 2018-06-25 22:03 +0700
    Re: Submitting *encrypted* forms via AJAX "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-06-25 17:21 +0200
      Re: Submitting *encrypted* forms via AJAX JJ <jj4public@vfemail.net> - 2018-06-26 14:59 +0700
        Re: Submitting *encrypted* forms via AJAX Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-26 16:47 +0200
          Re: Submitting *encrypted* forms via AJAX Richard Damon <Richard@Damon-Family.org> - 2018-06-26 21:09 -0400
            Re: Submitting *encrypted* forms via AJAX Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-27 09:45 +0200
              Re: Submitting *encrypted* forms via AJAX "Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid> - 2018-06-27 00:54 -0700
              Re: Submitting *encrypted* forms via AJAX Jon Ribbens <jon+usenet@unequivocal.eu> - 2018-06-27 13:29 +0000
                Re: Submitting *encrypted* forms via AJAX "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-06-27 15:47 +0200
                Re: Submitting *encrypted* forms via AJAX Ben Bacarisse <ben.usenet@bsb.me.uk> - 2018-06-27 16:00 +0100
                Re: Submitting *encrypted* forms via AJAX Julio Di Egidio <julio@diegidio.name> - 2018-06-27 08:11 -0700
                Re: Submitting *encrypted* forms via AJAX Ben Bacarisse <ben.usenet@bsb.me.uk> - 2018-06-28 01:53 +0100
                Re: Submitting *encrypted* forms via AJAX Julio Di Egidio <julio@diegidio.name> - 2018-06-27 21:48 -0700
                Re: Submitting *encrypted* forms via AJAX Jon Ribbens <jon+usenet@unequivocal.eu> - 2018-06-28 09:17 +0000
                Re: Submitting *encrypted* forms via AJAX Julio Di Egidio <julio@diegidio.name> - 2018-06-28 03:25 -0700
                Re: Submitting *encrypted* forms via AJAX "Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid> - 2018-06-27 14:04 -0700
                Re: Submitting *encrypted* forms via AJAX "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-06-28 13:54 +0200
                Re: Submitting *encrypted* forms via AJAX "Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid> - 2018-06-28 13:46 -0700
  Re: Submitting *encrypted* forms via AJAX jecxjo <jeff@sh0.xyz> - 2018-07-02 03:21 +0000
    Re: Submitting *encrypted* forms via AJAX Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-07-15 04:56 +0200
      Re: Submitting *encrypted* forms via AJAX "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2018-07-16 01:00 +0200

csiph-web