search

brix / crypto-js

JavaScript library of crypto standards.
Other
15.9k stars 2.39k forks source link

What is the point of this? #104

Open lansana opened 7 years ago

lansana commented 7 years ago

I understand what encryption/hashing is; that is not my question.

The question is how does this make any client secure if it requires a secret/private key in the client in order to run the encryption algorithms? If you use plain text, someone can read it and thus can decrypt your messages. Likewise if you provide the keys from a server, anyone can also look at the network logs and view the key coming in.

How can this be avoided? I don't understand..this seems rather useless to me because it's so easy to reverse engineer. Please educate me.

NuclearPhoenixx commented 7 years ago

Well, your concerns are fully understandable and obviously this is not intended for high security applications but it's an easy way to implement some client encryption and decryption.

For example: You and your friend share a password then you can both send and receive the messages and read them. That method is like semi-automatic because you both have to know the password, but this way there is no network logging or anything - so it's secure (as far as the js code and the password are of course). You can automate everything but the password transfer; I made an experimental app this way and it seems pretty nice so far.

lansana commented 7 years ago

Thanks for the explanation!

OwenMelbz commented 6 years ago

@lansana Javascript doesn't always run in the browser now days especially with Node backends.

But also theres no reason you have to transmit the encrypted data WITH the key.

e.g Imagine if store your key in localStorage on the browser, or via some other method, if the encrypted data gets sent to you, you then use the key you have to decrypt the data.

Also who is to say the key needs to be plain text? Maybe something like a user enters a password, which then gets hashed - maybe with argon2 - then the actual password is still hidden and just the result, so unless you're allowing the users to see the hashes again they wouldnt even know the key

I guess need to remember the whole point of encryption is that the data is decrypt-able - so theres always going to be some way to steal the final data.