News for hackers. Stuff that matters.

A comment on Minibone: practical end-to-end encryption for web apps. Parent comment

Re:Minibone: practical end-to-end encryption for web apps by tptacek on Tuesday April 09, 2024 @02:36AM (#39976696)
I don't know. Just do what this library does: encrypt rows with AES-GCM. Use random keys, push the keys to clients in cookies or to store in local storage. The server "sees" the key when incoming requests arrive, but doesn't store them.
[ Parent | on HN ]
Re:Minibone: practical end-to-end encryption for web apps by kisamoto on Tuesday April 09, 2024 @03:22AM (#39976931)
Thanks.

Hm I still would prefer plain text not leaving the device. There have been historical examples of plain text passwords ending up in logs (Twitter) so I would prefer encrypted on my device so there's no chance of interception (mistaken or purposeful) on the server.

Plus this would result in a loss of features - keys would then live only on a device for as long as the cookies/storage existed. New browser/device/clean storage the keys are lost and the ciphertext unable to be decrypted.

[ Parent | on HN ]