5 ms·
DON'T! Just don't. Encrypting user credentials in JS is probably even worse than parsing HTML with regular expressions: http://stackoverflow.com/questions/1732
by annnnd 13y ago
DON'T! Just don't.
Encrypting user credentials in JS is probably even worse than parsing HTML with regular expressions:
http://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags/1732454#1732454 http://stackoverflow.com/questions/1732348/regex-match-open-...
Just send it in cleartext, but over properly verified https.
- mr_luc 13y agoI've read the Matasano whitepaper on why you can't count on Javascript for security, as I imagine you have, and it makes sense. Use https. That being said, look at something like blockchain.info. It adds javascript security on top of https, and for (what seems like) excellent reasons.
- nopassrecover 13y agoI was just musing hypothetically, but can you elaborate on why this is bad? Surely sending an encoded password is better than a non-encoded one, and in a worst case only as bad as sending a cleartext password (i.e. what happens now).