3 ms·
If the encryption happens client side (even in browser) then it’s fine, as long as you (only) can access the private key. How to prove that this is the case is
by ssss11 3y ago
If the encryption happens client side (even in browser) then it’s fine, as long as you (only) can access the private key. How to prove that this is the case is a different question, is there a way other than open sourcing your code? I don’t think so
- MattPalmer1086 3y agoIf your browser has access to your private key, and you are running code on someone else's web site to perform cryptographic operations, then it can simply exfiltrate your private key.
- ryan-c 3y agothe WebCrypto API has an exportable: false option, though the fact that there's no way to serialize a non-exportable key limits the usefulness of this.