4 ms·
1. As discussed in another comment, this requires a similar level of trust to encrypting the data on the server. The only difference here is that, to the best o
by absherwin 13y ago
1. As discussed in another comment, this requires a similar level of trust to encrypting the data on the server. The only difference here is that, to the best of my knowledge, an attacker who took control of the server, could silently log the plaintexts in the server side case while some indication would be provided in the client-side case. Most wouldn't notice it but some would eventually.
2. The code I wrote isn't obfuscated. The code at the top is just SJCL and angular.js which are https://github.com/bitwiseshiftleft/sjcl https://github.com/bitwiseshiftleft/sjcl and https://github.com/angular/angular.js https://github.com/angular/angular.js
- AnIrishDuck 13y ago1. A server could silently insert code that replaces your keys with a well known one. Don't kid yourself into thinking anyone would notice this if it was silently tucked away in the minified angular or SJCL code. 2. Your definition of obfuscated and mine clearly differ. I'll be more direct: where's the (well-commented, clearly coded) model/controller code?
- absherwin 13y ago1. Agreed. That's an avenue by which a vulnerability in the server or communication channel could be exploited. 2. It doesn't exist. The code was written in the same form it was uploaded.