4 ms·
In practical terms, just use HTTPS with rooted certs. It's not expensive for basic usage. And, if you're just doing a for-fun project you can always use self-si
by johnm 18y ago
In practical terms, just use HTTPS with rooted certs. It's not expensive for basic usage. And, if you're just doing a for-fun project you can always use self-signed certs.
If you want to go deeper down the rabbit hole check out SRP: http://srp.stanford.edu/ http://srp.stanford.edu/
In terms of dealing more securely with data on your server, check out the book, Translucent Databases ( http://www.amazon.com/Translucent-Databases-Peter-Wayner/dp/0967584418 http://www.amazon.com/Translucent-Databases-Peter-Wayner/dp/... )
- tptacek 18y agoStay away from SRP. Browsers don't support it natively, and there are (so far as I can tell) no peer-reviewed libraries for it for the major web stacks. SRP is easy to get wrong.
- johnm 18y agoI did say to use SSL in practice, right? Reading about SRP would help solve much of confusion people seem to be having in many of the discussions going on in this thread.