Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #35317

Re: Submitting *encrypted* forms via AJAX

Path csiph.com!eternal-september.org!feeder.eternal-september.org!reader02.eternal-september.org!.POSTED!not-for-mail
From "Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid>
Newsgroups comp.lang.javascript
Subject Re: Submitting *encrypted* forms via AJAX
Date Wed, 27 Jun 2018 00:54:07 -0700
Organization n/a
Lines 31
Message-ID <pgvfr2$137$1@dont-email.me> (permalink)
References <075dc3b9-1b96-4bc9-9d88-a79ee815e8e2@googlegroups.com> <1ayv347oigack.t9kcyjsxesx9$.dlg@40tude.net> <pgr199$rfs$1@solani.org> <uvb47mtapk89.1jtol6uw3tk7p$.dlg@40tude.net> <5696879.fPQVyQoktA@PointedEars.de> <TsBYC.379957$br4.78508@fx34.iad> <3824731.5j0TqHaiX3@PointedEars.de>
Mime-Version 1.0
Content-Type text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding 8bit
Injection-Date Wed, 27 Jun 2018 07:54:11 -0000 (UTC)
Injection-Info reader02.eternal-september.org; posting-host="9a270b6d529bb13d7f048eb41d595b1a"; logging-data="1127"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19ftHxU4miWXyQl7gQzy485rekL44GF+rk="
User-Agent Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0
Cancel-Lock sha1:9YH06RIOuYdLsmRiQyHj68oks4k=
In-Reply-To <3824731.5j0TqHaiX3@PointedEars.de>
Content-Language en-US
Xref csiph.com comp.lang.javascript:35317

Show key headers only | View raw

On 6/27/2018 12:45 AM, Thomas 'PointedEars' Lahn wrote:
> Richard Damon wrote:
> 
>> On 6/26/18 10:47 AM, Thomas 'PointedEars' Lahn wrote:
>>> JJ wrote:
>>>> On Mon, 25 Jun 2018 17:21:14 +0200, Christoph M. Becker wrote:
>>>>> Kidding aside: why would you manually encrypt the form submission,
>>>>> instead of relying on TLS?
>>>> Why ask me? Maybe he want more security.
>>>
>>> JFYI (as apparently you did not get the joke):
>>>
>>> Data encryption in and by client-side script code is *false* security –
>>> “security by obscurity”: It does _not_ increase security *at all* because
>>> *you serve* the used encryption algorithm to a potential attacker.
>>> […]
>>
>> You provide the attacker with no more information than they have when
>> you use TLS, as the encryption algorithm is just as know.
> 
> Incorrect; read again.
> 
> To use an example that you should be able to understand: Encryption by
> client-scripting that is like locking the door of my house, and pin a post-
> it note to the door that says “@Burglar: The key is below the mat.”, where
> the key actually is.
> 

Have the client and server setup a DH or other asymmetric key exchange 
to generate a secret key that can be used for a session of communication?

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Submitting *encrypted* forms via AJAX bit-naughty@hotmail.com - 2018-06-25 02:48 -0700
  Re: Submitting *encrypted* forms via AJAX JJ <jj4public@vfemail.net> - 2018-06-25 22:03 +0700
    Re: Submitting *encrypted* forms via AJAX "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-06-25 17:21 +0200
      Re: Submitting *encrypted* forms via AJAX JJ <jj4public@vfemail.net> - 2018-06-26 14:59 +0700
        Re: Submitting *encrypted* forms via AJAX Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-26 16:47 +0200
          Re: Submitting *encrypted* forms via AJAX Richard Damon <Richard@Damon-Family.org> - 2018-06-26 21:09 -0400
            Re: Submitting *encrypted* forms via AJAX Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-06-27 09:45 +0200
              Re: Submitting *encrypted* forms via AJAX "Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid> - 2018-06-27 00:54 -0700
              Re: Submitting *encrypted* forms via AJAX Jon Ribbens <jon+usenet@unequivocal.eu> - 2018-06-27 13:29 +0000
                Re: Submitting *encrypted* forms via AJAX "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-06-27 15:47 +0200
                Re: Submitting *encrypted* forms via AJAX Ben Bacarisse <ben.usenet@bsb.me.uk> - 2018-06-27 16:00 +0100
                Re: Submitting *encrypted* forms via AJAX Julio Di Egidio <julio@diegidio.name> - 2018-06-27 08:11 -0700
                Re: Submitting *encrypted* forms via AJAX Ben Bacarisse <ben.usenet@bsb.me.uk> - 2018-06-28 01:53 +0100
                Re: Submitting *encrypted* forms via AJAX Julio Di Egidio <julio@diegidio.name> - 2018-06-27 21:48 -0700
                Re: Submitting *encrypted* forms via AJAX Jon Ribbens <jon+usenet@unequivocal.eu> - 2018-06-28 09:17 +0000
                Re: Submitting *encrypted* forms via AJAX Julio Di Egidio <julio@diegidio.name> - 2018-06-28 03:25 -0700
                Re: Submitting *encrypted* forms via AJAX "Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid> - 2018-06-27 14:04 -0700
                Re: Submitting *encrypted* forms via AJAX "Christoph M. Becker" <cmbecker69@arcor.de> - 2018-06-28 13:54 +0200
                Re: Submitting *encrypted* forms via AJAX "Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid> - 2018-06-28 13:46 -0700
  Re: Submitting *encrypted* forms via AJAX jecxjo <jeff@sh0.xyz> - 2018-07-02 03:21 +0000
    Re: Submitting *encrypted* forms via AJAX Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-07-15 04:56 +0200
      Re: Submitting *encrypted* forms via AJAX "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2018-07-16 01:00 +0200

csiph-web