0
$\begingroup$

I have to send user data from a form to server side and process it. But I would like to encrypt this information to make sure the information is safe.

I am using a random word Array as salt, another random word array as IV, userId as passphrase to encrypt the password. Same salt and IV, password (without encryption) as passphrase is used to encrypt userId.

Salt, IV, userId (both plain and encrypted), encrypted password is sent to server side where the reverse operation is performed to decrypt the data.

But since passphrase is also available at client end, this doesn't seem safe. What is the best way to achieve this?

Improve this question
$\endgroup$
2
  • $\begingroup$ eee... what about using SSL/TLS (https) ?? $\endgroup$
    – gusto2
    Commented Dec 8, 2017 at 13:16
  • $\begingroup$ The best way is to use HTTPs, why are you trying to do it this way? $\endgroup$
    – Kritner
    Commented Dec 8, 2017 at 13:22

2 Answers 2

Reset to default
2
$\begingroup$

If you are not using SSL/TLS on the web server, any man-in-the-middle can tamper with the javascript code as it is pushed from the server to the client. At that point, an attacker can disable any client-side protections you have added. So, without SSL/TLS, anything you do is basically useless.

Now, once you enable SSL/TLS on the server and force users to connect via that secure connection, all information is protected in transit already, so no additional protections are needed.

So, enable SSL/TLS on the server and force all connections to use that and you are good to go.

Improve this answer
$\endgroup$
1
$\begingroup$

The number one rule with encryption is never try to do it yourself. You will never make anything anywhere near secure what the professionals already have.

If your JavaScript is running in a browser, you must also think about encrypting the code on the way to your computer since it could be tampered with. TLS, provides authentication (making sure it comes from the right person) and encryption (making sure no one else can see it) in both directions. You can turn this on for your web server. If you want to do it properly will need to buy/get a verified certificate from a certificate authority like LetsEncrypt.

However, if you are not running your JavaScript on a browser, but instead in a standalone app, you can still use TLS, but I suggest using certificate pinning, which embeds a fixed certificate key inside the application.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.