Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: "J.O. Aho" Newsgroups: comp.lang.php Subject: Re: HTTPS data in a form Date: Tue, 20 Sep 2016 18:39:21 +0200 Lines: 32 Message-ID: References: <52647a62-05fe-ade7-9de8-e434f646aad9@arnowelzel.de> <2368565.mvXUDI8C0e@PointedEars.de> <0538bd0a-15af-6afe-260c-38fb970c56d9@arnowelzel.de> <3934285.LvFx2qVVIh@PointedEars.de> <9003351.nUPlyArG6x@PointedEars.de> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Trace: individual.net iTYjsoq9bXNmdzQGCAA1Cgl/Hseqh+fpBEQuFWqfroeCdnibOJ Cancel-Lock: sha1:DfMoj7b4fMvEYbboPB/A2r81mgI= X-Enigmail-Draft-Status: N1110 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.8.0 In-Reply-To: <9003351.nUPlyArG6x@PointedEars.de> Xref: csiph.com comp.lang.php:17079 On 09/20/2016 03:40 PM, Thomas 'PointedEars' Lahn wrote: > Stefan Froehlich wrote: > >> On Mon, 19 Sep 2016 23:28:27 Thomas 'PointedEars' Lahn wrote: >>> because the used encryption/hashing algorithm would have to reside >>> on the client in the form of a client-side script *for every >>> attacker plain to see* (obfuscation is _not_ protection). >> >> If you use asymmetric encryption this would not be the big problem. > > Exposing the used encryption algorithm to a potential attacker is a security > leak. It is a big problem in any case. Not at all, just see how PGP works, you send you public key to people, they encrypt the e-mail and send it to you, you can decrypt it with your private key. Even if they have your public key, they will not be able to generate your private key not use the public key to decrypt any messages encrypted with it. Most encryption is done with "exposed" algorithms, for example openssl source code is free for grabs and most algorithms are anyway publicly documented, so you will be able to build your own encryption/decryption functionality. No difference if you do it in javascript, c++, c# or your own created language, seeing the code will not make people just able to decrypt things, unless it's rot_13. -- //Aho