7 ms·
Client side decryption has the benefit that no machine or router in the middle can view or cache the decrypted page without the password.
by pdq 4y ago
Client side decryption has the benefit that no machine or router in the middle can view or cache the decrypted page without the password.
- tptacek 4y agoYou mean, unless they tamper with the Javascript to capture the password (or the derived key).
- dividuum 4y agoI designed a similar tool with that threat model in mind: the resulting HTML/JS is as minimal as possible so it’s possible to inspect before entering the password. Of course assumes safe browser and client machine.. https://github.com/dividuum/html-vault https://github.com/dividuum/html-vault
- viraptor 4y agoKind of possible. With enough content, would you actually spot a "}; and some highly obfuscated code in the middle of the blob? (My guess is a no)
- dividuum 4y agoYou're right. Probably not. But at least the chance exists as there isn't a multi-KB obfuscated JS dependency somewhere that would be a lot harder to handle.
- efreak 4y agoValid if you actually host the file online. Local files are generally not allowed to make requests. Not sure if local storage methods are usable without http/s.