2 ms·

Hi Thomas, thanks for the feedback, I was hoping you would turn up... Its very true, if someone broke into the server (or I was malicious) they could replace t

Hi Thomas, thanks for the feedback, I was hoping you would turn up... Its very true, if someone broke into the server (or I was malicious) they could replace the js with code that after decrypting the page sends it onto somewhere else in plain text. I did consider that situation when putting it together and added the ssl security to help prevent MITM attacks. I don't really intend this to be a way to share content in a secure manner, as you said there are much better tools for that. It is really an experiment in how you could built a tool where the server doesn't know, because it doesn't want to, what content people have submitted to the site. As you know the url fragment is not sent to the server and so I never see the encryption key.

tptacek 15y ago
Random question: where did this particularly implementation of CTR mode come from?
- samwillis 15y ago
  Its the one from http://www.movable-type.co.uk/scripts/aes.html http://www.movable-type.co.uk/scripts/aes.html I am considering moving to the http://code.google.com/p/crypto-js/ http://code.google.com/p/crypto-js/ version as I'm not sure that it is currently producing keys in the best way.
Zikes 15y ago
When the URL is linked, wouldn't the fragment be sent as a referrer when loading page resources?
- phpnode 15y ago
  no, the fragment is never sent to the server by the browser.
  - samwillis 15y ago
    Exactly, its not included in the referrer header, only the resource location is.