3 ms·

Thanks. That's a very interesting idea - I like it since users can't access each others' information. Now I'll just have to think about handling the "Forgot Pa

Thanks. That's a very interesting idea - I like it since users can't access each others' information. Now I'll just have to think about handling the "Forgot Password" functionality. I'm not sure for #3 if I do need to see the information although I worry that my users would be using it for nefarious purposes.

coo1k 10y ago
There is a way to get around #3 although inefficient. Everytime information is posted by your users you can create 2 copies of encrypted information. One with users password for them to view. The other would be using your key, but you cant simply use password for encrypting your copy, that would be insecure since you need to store your password on server. Instead you can use asymmetric encryption such that you can use your public key to encrypt the information. Then you can use your private key to login to you website and view all information.
- tixocloud 10y ago
  Basically my database will always be 2X? Curious but given that WhatApp recently encrypts messaging end-to-end, does this mean that even they can't view the information? Does this mean WhatsApp would have no way of detecting if it's application is being used for organizing illegal activity?
  - coo1k 10y ago
    Yes. See para 2. https://blog.whatsapp.com/10000618/end-to-end-encryption https://blog.whatsapp.com/10000618/end-to-end-encryption
  - coo1k 10y ago
    OR you could encrypt user password with your public key. Then when you login, you can decrypt user password with your private key. Then go on decrypting user information with that password. This way you won't have to make copy of information posted by users and still will be able to view it with admin login.
    - zimpenfish 10y ago
      Doesn't that mean anyone who captures the "admin" private key has full access to the database?
      - coo1k 10y ago
        Yes, but since the key resides with admin and not on server, I am assuming the private key will be stored securely.

coo1k 10y ago

There is a way to get around #3 although inefficient. Everytime information is posted by your users you can create 2 copies of encrypted information. One with users password for them to view. The other would be using your key, but you cant simply use password for encrypting your copy, that would be insecure since you need to store your password on server. Instead you can use asymmetric encryption such that you can use your public key to encrypt the information. Then you can use your private key to login to you website and view all information.

tixocloud 10y ago
Basically my database will always be 2X? Curious but given that WhatApp recently encrypts messaging end-to-end, does this mean that even they can't view the information? Does this mean WhatsApp would have no way of detecting if it's application is being used for organizing illegal activity?
- coo1k 10y ago
  Yes. See para 2. https://blog.whatsapp.com/10000618/end-to-end-encryption https://blog.whatsapp.com/10000618/end-to-end-encryption
- coo1k 10y ago
  OR you could encrypt user password with your public key. Then when you login, you can decrypt user password with your private key. Then go on decrypting user information with that password. This way you won't have to make copy of information posted by users and still will be able to view it with admin login.
  - zimpenfish 10y ago
    Doesn't that mean anyone who captures the "admin" private key has full access to the database?
    - coo1k 10y ago
      Yes, but since the key resides with admin and not on server, I am assuming the private key will be stored securely.