Secret key for AES encryption

[9px]

using of valid HTTPS is not free, and using of HTTP is insecure.

also SECRET key can be listening by an attacker over HTTP.

it is desirable to use SECRET-key as key for encrypt exchanged data with method such as AES.

if this feature request approved, you can add an option to disable this as default for compatibility with older version PHP code.

[eyedol]

@9px asking for more clarification. You saying we should replace the use of secret with SECRET-key as the request variable?

[9px]

@eyedol first; thanks for your attention. no. i suggest an option to adding in SMSSync setting: AES secret key if user set the option, data exchange with server will be encrypt by the AES secret key instead of current plain data exchange. naturally; for URL-safe data exchange, encrypted data must be encoded by base64.

[rjmackay]

@9px Am I right that you're asking for us to encrypt the secret key when in transit between SMSSync and the server? I'm not really sure we have the expertise / bandwidth to build something like that.. unless theres some existing encrypted auth scheme and libs we could rely on..

Aside: there are a number of free SSL cert providers now.

[9px]

@rjmackay no. i say: instead of send/get sms text to/from server in simple plain text, send/get it with an encryption method. (such as AES). this is very safe against sniffing HTTP trafic or MITM attack in HTTPS.

[redbullpeter]

Some crypto info here: https://www.owasp.org/index.php/Java_Security_Frameworks

You could use this library: https://github.com/google/keyczar on the client end. To keep it simple, you could for example fix the encyption algorithm and use only a symmetric key system. The complexity starts on how to decrypt on the server end as that's not something you will have control over. Depending on the server environment the necessary libraries may not be installed.

[9px]

thanks @redbullpeter. in server side usualy available encrypt/decrypt function/module for each language. for example in PHP we have some built-in function to do this, also in python, nodejs, etc.