A friend of mine needed help with her website and asked how to send me her login information securely. I've never known how to do this, so I figured now was the time to learn. After some googling, I suggested sending me an SMS or a password-protected zip file. Then, just for fun, I programmed this:
<html>
<head>
<title>AES Encrypt/Decrypt Page</title>
<script src="http://herbaloutfitters.com/cryptojs/rollups/aes.js"></script>
<SCRIPT LANGUAGE="JavaScript">
function aes_enc(form) {
var encrypted = CryptoJS.AES.encrypt(form.thetext.value, form.passkey.value);
form.thetext.value = encrypted;
}
function aes_dec(form) {
var decrypted = CryptoJS.AES.decrypt(form.thetext.value, form.passkey.value);
form.thetext.value = decrypted.toString(CryptoJS.enc.Utf8);
}
</script>
</head>
<body>
<form method="POST">
<textarea name="thetext" rows="11" cols="35"></textarea><br>
Passkey: <input type="text" name="passkey" size="16"><br>
<input type=button name=enc value="Encrypt" onClick="javascript:aes_enc(this.form)"><br>
<input type=button name=dec value="Decrypt" onClick="javascript:aes_dec(this.form)">
</form>
</body>
</html>
See the above code in action here: herbaloutfitters.com/crypto.html
My question is: how secure is this? Is it more or less secure than the SMS or zip file solution? Is there a better way that's easy enough for the average person to use without much greater difficulty than these solutions? (I thought about encrypting gmail or Thunderbird, but these seemed more time-consuming. The average person would probably not want to bother.)
EDIT:
People have requested I define "secure." I thought people might ask that, so that's why I asked to compare to the security of SMS and password-protected ZIP file. Of course, nothing is ever truly secure. Phones can be tapped, people overhear, emails read, etc.
One person cited that one'd be at the mercy of a third-party by using their code. In this case, I d/led it to my server and inspected it for malicious code. Anyone using my page could do the same.
Why not give the info over the phone? That seems less secure, doesn't it?
AES requiring both sides to have the same key, and if you have a channel to securely exchange a key, you have a channel to securely exchange the original message. True, but the key could be provided via hinting at something only the two parties know. Not all that secure, I know, but in this use case, I've found public-private key encryption is too difficult for people to understand. They'd get frustrated and go back to unencrypted email or a phone call.
Encrypted IMing. This might be more secure, provided I trust the developer AND the client is willing to go through the trouble of installing the software. Usually neither is the case. Basically, what I'm looking for is the easiest way to transfer login info in the most secure way possible that's still convenient to actually be used by real world clients unfamiliar with encryption and the more technical aspects of computers. The above page I programmed (plus SMS) is my solution. (Many would also have trouble with password-protecting a zip file.) I'm just wondering if I've made a gross miscalculation in how secure it is by overlooking something, given how little I know about network security.
EDIT to address being put on hold: I believe my initial question was specific enough but may appear non-specific because I chose to address the proposed solutions, which made it appear as though I was asking for other solutions. No, my question is specific to the particular code I wrote, asking how it compares to the security of SMS and a password-protected zip file. That's all. I know there are more secure ways to transfer login info, but I am not interested in that in this question. I just want to know if there's a glaring vulnerability in my own specific solution. I am also not interested in the definition of "security," as that would also be too broad. As long as my solution is reasonably secure (as determined by comparing it to known, reasonably secure solutions, like SMS and a password-protected zip file), I will be happy.
