3 ms·
So leaking my private key to somebody is OK if I do so over HTTPS, and even better if I encrypt it with a javascript crypto library beforehand? I don't think y
by ctz 13y ago
So leaking my private key to somebody is OK if I do so over HTTPS, and even better if I encrypt it with a javascript crypto library beforehand?
I don't think you've thought this through.
- redblacktree 13y agoI think he was suggesting that, instead of sending the private key to this web server, the check they're doing could be implemented client-side, thus avoiding the need for the key to transit the wire. I haven't been able to access the site though, so I may be way off in my understanding of what it does.
- jawr 13y agoSending it over HTTPS at least narrows down the recipient to.. who it's intended for. And I wasn't suggesting encrypting and then sending it to them, instead perform the check on the client side in a way that no information is ever sent back to their server; using the browser as a platform to run an "app". I don't condone this at all, but if they're adamant about providing this service they should at least try and make it less damning than it already is.