Path: csiph.com!eternal-september.org!feeder.eternal-september.org!reader02.eternal-september.org!.POSTED!not-for-mail
From: "Chris M. Thomasson" <invalid_chris_thomasson@invalid.invalid>
Newsgroups: comp.lang.javascript
Subject: Re: Submitting *encrypted* forms via AJAX
Date: Wed, 27 Jun 2018 00:54:07 -0700
Organization: n/a
Lines: 31
Message-ID: <pgvfr2$137$1@dont-email.me>
References: <075dc3b9-1b96-4bc9-9d88-a79ee815e8e2@googlegroups.com> <1ayv347oigack.t9kcyjsxesx9$.dlg@40tude.net> <pgr199$rfs$1@solani.org> <uvb47mtapk89.1jtol6uw3tk7p$.dlg@40tude.net> <5696879.fPQVyQoktA@PointedEars.de> <TsBYC.379957$br4.78508@fx34.iad> <3824731.5j0TqHaiX3@PointedEars.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Injection-Date: Wed, 27 Jun 2018 07:54:11 -0000 (UTC)
Injection-Info: reader02.eternal-september.org; posting-host="9a270b6d529bb13d7f048eb41d595b1a"; logging-data="1127"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX19ftHxU4miWXyQl7gQzy485rekL44GF+rk="
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0
Cancel-Lock: sha1:9YH06RIOuYdLsmRiQyHj68oks4k=
In-Reply-To: <3824731.5j0TqHaiX3@PointedEars.de>
Content-Language: en-US
Xref: csiph.com comp.lang.javascript:35317

On 6/27/2018 12:45 AM, Thomas 'PointedEars' Lahn wrote:
> Richard Damon wrote:
> 
>> On 6/26/18 10:47 AM, Thomas 'PointedEars' Lahn wrote:
>>> JJ wrote:
>>>> On Mon, 25 Jun 2018 17:21:14 +0200, Christoph M. Becker wrote:
>>>>> Kidding aside: why would you manually encrypt the form submission,
>>>>> instead of relying on TLS?
>>>> Why ask me? Maybe he want more security.
>>>
>>> JFYI (as apparently you did not get the joke):
>>>
>>> Data encryption in and by client-side script code is *false* security –
>>> “security by obscurity”: It does _not_ increase security *at all* because
>>> *you serve* the used encryption algorithm to a potential attacker.
>>> […]
>>
>> You provide the attacker with no more information than they have when
>> you use TLS, as the encryption algorithm is just as know.
> 
> Incorrect; read again.
> 
> To use an example that you should be able to understand: Encryption by
> client-scripting that is like locking the door of my house, and pin a post-
> it note to the door that says “@Burglar: The key is below the mat.”, where
> the key actually is.
> 

Have the client and server setup a DH or other asymmetric key exchange 
to generate a secret key that can be used for a session of communication?