4 ms·
Well you could implement public key authentication in javascript with a password derived public key. But someone could still intercept your session cookie. Yo
by jacob019 6y ago
Well you could implement public key authentication in javascript with a password derived public key. But someone could still intercept your session cookie. You could take it even further and build out an encrypted channel, websocket, or just message based, to send all the data over and use client side rendering. Probably too complicated, but if implemented properly, it would work.
- cesarb 6y agoNo matter how complicated you make it, a man-in-the-middle pretending to be the device can simply replace your authentication JavaScript. The only way to stop an active attacker from doing that is to authenticate the device to the browser, and this cannot be done in unauthenticated JavaScript sent from the device.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]