3 ms·

How can you do client side encryption with web apps though? While keeping the key on the client, I assume, and allowing multiple browser sessions for the same u

• candiddevmike 3y ago
  Envelope encryption, where you encrypt a data encryption key (typically symmetric with AES) with other keys (typically asymmetric with RSA). This is how most password safes like bitwarden work.
  • TheNewsIsHere 3y ago
    This model reminds me of sealed boxes, so I wanted to add that to this discussion. Send a public key to the client (say in a secrets input page), your browser encrypts field content with that key, and you receive the ciphertext on the server. You can then decrypt it, discard the sealed box keys, and persist the data however you need. (Presumably something that sensitive would get encrypted with a different key before going into the database, but you could keep the keys around and have each piece of data protected by a different key. This has pros and cons.) Github Actions secrets are protected in transit to Github using sealed boxes.
• hn_throwaway_99 3y ago
  When I say "client side encryption", I'm referring to the database client, which in most web apps is actually code running on a private server (i.e. browser code makes API calls to a server running something like Python, Node or Java, and that server code makes calls to the DB - it's on the server where PII is encrypted). That said, you can also use the SubtleCrypto API in the browser to encrypt data before it is even sent to the server.
• patmorgan23 3y ago
  I believe by client side they mean the database client, which would be the application backend/server.