Path: csiph.com!eternal-september.org!feeder.eternal-september.org!reader02.eternal-september.org!.POSTED!not-for-mail From: Ben Bacarisse Newsgroups: comp.lang.javascript Subject: Re: Submitting *encrypted* forms via AJAX Date: Wed, 27 Jun 2018 16:00:04 +0100 Organization: A noiseless patient Spider Lines: 30 Message-ID: <87zhzgp957.fsf@bsb.me.uk> References: <075dc3b9-1b96-4bc9-9d88-a79ee815e8e2@googlegroups.com> <1ayv347oigack.t9kcyjsxesx9$.dlg@40tude.net> <5696879.fPQVyQoktA@PointedEars.de> <3824731.5j0TqHaiX3@PointedEars.de> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Injection-Info: reader02.eternal-september.org; posting-host="2c488b9cf542482d9a9e534322905e52"; logging-data="21556"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19h30ZRTjjiRRPTP+1NYYX+wf4XzDJROqE=" Cancel-Lock: sha1:qPtdsyLOntrbNPtO3gAcyVINvG0= sha1:0h+/lV8/odfTe6OpHZ18tgY4Lyw= X-BSB-Auth: 1.d3758a3fed5461424e78.20180627160004BST.87zhzgp957.fsf@bsb.me.uk Xref: csiph.com comp.lang.javascript:35320 "Christoph M. Becker" writes: > On 27.06.2018 at 15:29, Jon Ribbens wrote: > >> On 2018-06-27, Thomas 'PointedEars' Lahn wrote: >> >>> Richard Damon wrote: >>> >>>> You provide the attacker with no more information than they have when >>>> you use TLS, as the encryption algorithm is just as know. >>> >>> Incorrect; read again. >>> >>> To use an example that you should be able to understand: Encryption by >>> client-scripting that is like locking the door of my house, and pin a post- >>> it note to the door that says “@Burglar: The key is below the mat.”, where >>> the key actually is. >> >> You should look into this newfangled thing called "asymmetric encryption". > > I'm afraid we're way off topic for c.l.js. However, as I see it, you'd > have to deliver the *private* key to the client, which may not be the > best idea, anyway. It's perfectly possible to do authentication over an insecure connection by running cryptographic code in the client. Maybe Thomas Lahn has some narrow meaning in mind for his words, but if so he's not saying. -- Ben.