CODEWITHSUNDEEP
securityhttps
Steverino
Steverino

Reputation: 2266

How can I safely get user passwords to the back end without HTTPS?

I'm trying to get a hobby/educational project off the ground that involves user accounts. Naturally, it will be critical for users to be able to log in securely. The information I will be storing and transporting for users is not intended to be personal or personally identifiable, but just on principle I'd like password transport to be as secure as possible.

I understand that the best way to get the user's password safely to the back end from the front is by using HTTPS. However, I don't want to pay for a CA for this learning/experiment project, and I also don't want to get browser warnings for self-signed certs, because though this is a hobby project, I would ultimately like to share it with the world (like a portfolio piece, something to share with friends, for people to actually find useful and fun).

Granted, you'd be right to say that if I want it to be a "portfolio piece," I should use best practices such as HTTPS, but I still don't want to pay an annual CA fee for what ultimately is a hobby/learning project.

I'm considering the asymmetric cryptography solution found here: https://github.com/travist/jsencrypt It's quite like the one suggested by ArthuruhtrA, and seems promising. It uses public/private key, so I could encrypt using public key on the front end, and transport encrypted to be decrypted on the back end with a secret/private key (where proper salting/hashing practices would occur before storage to a database). Does this seem reasonably safe, if untraditional?

Is there any other, better way to get user information (e.g. password) safely to the back end without browser warnings and without spending money needlessly?

Upvotes: 0

Views: 325

Answers (2)

ArthuruhtrA
ArthuruhtrA

Reputation: 27

I don't know what the best answer to this is. Obviously you've considered using a self-signed cert. I may be wrong, but depending on the OS and browser, you may be able to tell it to trust certs you have signed.

Another solution might be to use the asymmetric cryptography principle behind HTTPS, but without actually using SSL: Include your server's public key in your webpage. Use javascript to encrypt the data with it. Your server would then be able to decrypt it using its private key, without a middleman being able to do so.

Hope that helps! If I come up with something else I'll add it here.

Edit: On second thought, this solution would be super vulnerable to a man-in-the-middle attack. Sorry.

Upvotes: 0

Nicolas Henneaux
Nicolas Henneaux

Reputation: 12205

If you use encrypted password from JavaScript it cannot be well secure since it is only client side customisation, i.e. it is not à service provided by the browser.

I would advise you to use TLS with a free certificate. You should have à look at letsencrypt.org.

Upvotes: 3

Related Questions