4 ms·

Couldn't browsers be juiced up to support client side encryption via local private key of a text area before form submission? That coupled with automatic publi

Couldn't browsers be juiced up to support client side encryption via local private key of a text area before form submission? That coupled with automatic public key decryption would enable gmail, for instance, to actually be secure(-ish-at-least-more-so). I think. Yes? The general facility of client side private key encryption before form submission of both text fields, areas, and files seems like it would be very useful. Not sure why that's not planned for, say, html5. Odds are I'm sprinkling my own ignorance all over this :)

mike-cardwell 13y ago
http://webpg.org/ http://webpg.org/ If this sort of functionality was standardised, simplified and baked in to the major browsers, we'd be able to build all sorts of wonderful software on top of it.
cool-RR 13y ago
You lose backend search this way. It's a critical feature.
- methehack 13y ago
  Seems like if you really cared for the contents of a textarea, for instance, you could tokenize the text client side and encrypt each token with the client side private key then you could similarly encrypt the search tokens client side and search serverside not knowing what you were searching for. However, I take your point. Lots of work, not quite the same. It still seems like the facility should be baked in though so that application's could make the proper tradeoffs.
  - arjunnarayan 13y ago
    Seems super vulnerable to frequency analysis though. However, if this is a path you might want to go down, you might want to look at CryptDB, a research project that looks at keeping a server side encrypted database and allows for queries in a principled way: http://css.csail.mit.edu/cryptdb/ http://css.csail.mit.edu/cryptdb/
  - michaelt 13y ago
    Products like CipherCloud reportedly work like you suggest. Unfortunately it's not very secure. If you split the text into words, discard case and encrypt each word, the NSA can just e-mail you a dictionary file, match the line numbers in the dictionary file ciphertext to line numbers in the dictionary file plaintext, and they've got your secret decoder ring (at least for every word in the dictionary file).
- chongli 13y ago
  This is where we really need fully homomorphic encryption!
  - sp332 13y ago
    Something like text search should only need partially-homomorphic encryption. For example: encrypt each byte with the same key. Then to search, encrypt the bytes of your search term and send them to the backend. It should be able to find them without knowing what your search term was. There are issues with this exact scheme of course but you get the idea!
- croikle 13y ago
  There is some research in this area, e.g. http://www.cs.berkeley.edu/~dawnsong/papers/se.pdf http://www.cs.berkeley.edu/~dawnsong/papers/se.pdf
bokchoi 13y ago
Mailvelope is another client-side browser extension that uses OpenPGP.js to encrypt email that works with gmail, outlook.com, Y! mail: http://www.mailvelope.com/ http://www.mailvelope.com/

mike-cardwell 13y ago

http://webpg.org/ http://webpg.org/ If this sort of functionality was standardised, simplified and baked in to the major browsers, we'd be able to build all sorts of wonderful software on top of it.

cool-RR 13y ago

You lose backend search this way. It's a critical feature.

methehack 13y ago
Seems like if you really cared for the contents of a textarea, for instance, you could tokenize the text client side and encrypt each token with the client side private key then you could similarly encrypt the search tokens client side and search serverside not knowing what you were searching for. However, I take your point. Lots of work, not quite the same. It still seems like the facility should be baked in though so that application's could make the proper tradeoffs.
- arjunnarayan 13y ago
  Seems super vulnerable to frequency analysis though. However, if this is a path you might want to go down, you might want to look at CryptDB, a research project that looks at keeping a server side encrypted database and allows for queries in a principled way: http://css.csail.mit.edu/cryptdb/ http://css.csail.mit.edu/cryptdb/
- michaelt 13y ago
  Products like CipherCloud reportedly work like you suggest. Unfortunately it's not very secure. If you split the text into words, discard case and encrypt each word, the NSA can just e-mail you a dictionary file, match the line numbers in the dictionary file ciphertext to line numbers in the dictionary file plaintext, and they've got your secret decoder ring (at least for every word in the dictionary file).
chongli 13y ago
This is where we really need fully homomorphic encryption!
- sp332 13y ago
  Something like text search should only need partially-homomorphic encryption. For example: encrypt each byte with the same key. Then to search, encrypt the bytes of your search term and send them to the backend. It should be able to find them without knowing what your search term was. There are issues with this exact scheme of course but you get the idea!
croikle 13y ago
There is some research in this area, e.g. http://www.cs.berkeley.edu/~dawnsong/papers/se.pdf http://www.cs.berkeley.edu/~dawnsong/papers/se.pdf

bokchoi 13y ago

Mailvelope is another client-side browser extension that uses OpenPGP.js to encrypt email that works with gmail, outlook.com, Y! mail: http://www.mailvelope.com/ http://www.mailvelope.com/