4 ms·
There is no way to validate the public key the data is encrypted against, so a man in the middle is possible by injecting a new public key and intercepting the
by dryicerx 17y ago
There is no way to validate the public key the data is encrypted against, so a man in the middle is possible by injecting a new public key and intercepting the cypher-text on its way back.
Just my though, if this type of security is needed, why forego SSL?
- brown9-2 17y agoThe author claims SSL is neither supported by every webhost nor it’s easy to install/apply sometimes. Not sure if I totally buy that - if you are collecting data you want to protect, surely it's worth it for you to use a host that's capable of installing SSL. It's a pretty simple operation.
- tptacek 17y agoInjecting a new public key? Heh. You can MITM this library just by inserting a JS tag into the DOM that turns its "encryption" off. No need to be clever.
- dryicerx 17y agoThis will tip the server off as it won't receive the expected cyphertext. By doing a mitm interception with a newly injected public key and re-encrypting with the real key before sending to server, you can let the client-server carry on a conversation as usual, while you intercept the entire conversation. [Client] ---(fakekey)---- MITM ----(realkey)---- [Server]
- NateLawson 17y agoI don't think it needs to be that complicated. Just add a new comment field that contains the session key in plaintext. Neither the server nor client ever knows the difference.