CODEWITHSUNDEEP
phpjavascriptsecuritybrowserencryption
acutesoftware
acutesoftware

Reputation: 1091

Encrypting data before it gets to the server

Say I have a PHP application and want the users data to be encrypted before it it gets to the server (to prove to users that their data will not be data mined or resold for advertising).

Similar question was asked here ( Secure Javascript encryption library? ) and implies that this is not going to work, but with the increase in privacy interest amonsgt users this requirement is only going to get greater over time.

Example, using the Stanford library (http://crypto.stanford.edu/sjcl/) a web form has an additional ‘long’ password field which the user pastes in (probably from email for example)

  sjcl.encrypt(txtPassword, txtFormFieldToBeEncrypted)

The encrypted data is sent to the PHP page, and the process is reversed when the page is loaded.

Would this work if the users used Chrome or another browser that remembers form values - obviously this is not a secure result, but would this be effective enough to keep the users information private from the host server?

EDIT: Just to be clear, I am only interested in making the information invisible to the host server, and understand that this solution wont protect from 3rd party attacks

Upvotes: 1

Views: 2062

Answers (4)

Adam Bliss
Adam Bliss

Reputation: 645

Here are a bunch of reasons why javascript encryption in the browser is almost always a bad idea.

You need to think deeply about your trust model. Do the users trust the server? If not, there is no hope for trustworthy javascript crypto since the crypto software itself comes from the server. If the users do trust the server, why does the data need to be encrypted client-side? Just use SSL to secure the connection, then have the server encrypt the data before storing it.

Upvotes: 1

deceze
deceze

Reputation: 522165

It's perfectly possible to do this, Lastpass for instance built their business model on it. All their server does is store an encrypted blob which they cannot do anything with, all encryption and decryption happens on the client; including a Javascript implementation in the browser. The entire blob of encrypted data is downloaded into the client, where the user's password decrypts it; and in reverse on the way back up to the server.

So if your question is whether it's possible: absolutely. It's also a lot of work, since you will need to be providing the same en-/decryption code for as many platforms as you want to support. You'll also need to secure every context where that code will run, to prevent third parties from injecting code which would allow them to access the client side decrypted data. So, everything needs to go over SSL with no 3rd party content being allowed to be injected.

Upvotes: 1

Piotr Stapp
Piotr Stapp

Reputation: 19830

First of all use SSL it is for an only way for secure communication. If you make encryption in JavaScript it is trivial to decrypt your message (because all your code with keys is public).

If you worry about CFRS attack use anti-forgery token (more here: http://bkcore.com/blog/code/nocsrf-php-class.html)

Upvotes: 1

Jan Jongboom
Jan Jongboom

Reputation: 27322

Protection on the page is useless, for the simple fact that the encryption key / mechanism will also be in the scope of the page and can thus be tampered with by a malicious party (or by the user itself when inspecting the page).

To avoid data going over the line unencrypted there is also no reason to "roll your own"(tm), because for that there is SSL.

If you want to make sure that the data that you receive on the server was actually originating from a page that you control, you can rely on CSRF protection.

Upvotes: 1

Related Questions