In our case, we were using this Encrypt() method to experiment with storing some state data in web pages related to the login process. We thought it was secure,

In our case, we were using this Encrypt() method to experiment with storing some state data in web pages related to the login process. We thought it was secure, because the data was encrypted. Sure it's encrypted! It says Encrypt() right there in the method name, right? !!!!!!! There are two cases when you might want to send sensitive data to the end user: You may wish to send them something and have them send it back in an unmanipulated block, or you may wish to have them manipulate it in some way and send it back to you. In the first case the best practice is to store the data on the server side and send a pointer (key) to the data. The key is inherently meaningless and sparse relative to its space, and is therefore difficult to attack in any meaningful way. The second case would rely on the web server sending a piece of (javascript) code to the browser to manipulate the crypto data. If you can see the encrypted text and the plaintext javascript routine you're a trival hack away from rewriting the javascript to have it change the encrypted text. This moves the problem from a crypto problem to a javascript coding exercise. The proper solution in this case is to use a form of crypto that is outside the realm of the HTTP session (read: SSL).