7 ms·
Since no one has brought it up yet -- I figured I would. The entire time I read this article, I was thinking of Clipperz (https://www.clipperz.com https://www.c
by LogicX 15y ago
Since no one has brought it up yet -- I figured I would.
The entire time I read this article, I was thinking of Clipperz (https://www.clipperz.com https://www.clipperz.com)
Their entire product is based on the model of in-browser cryptography of your credential payload.
You can read more here: http://www.clipperz.com/security_privacy http://www.clipperz.com/security_privacy
and numerous blog entries, and other articles around the web, but its open source, so you're welcome to review it yourself.
The basic premise is that your browser, through javascript, deals with encrypting and decrypting a blob object which is stored on their server, transmitted via SSL, which they can't read, and can only be read by you when your browser decrypts it with javascript.
I'd love to see the author's take on the Clipperz implementation.
- marshray 15y ago(note: not the author) At first glance, without going so far as to create an account, they do a lot of stuff right. I note that the HTTP session cookies set pre-authentication are not 'secure'. I.e., they can be be sent in-the-clear for HTTP connections as well. This may or may not be a real problem in practice.