5 ms·
Why can't the browser do the crypto on your input, before it even gets to the site/js? (e.g., expose a secure input and output API (say, a new type of HTML text
by Lx1oG-AWb6h_ZG0 12y ago
Why can't the browser do the crypto on your input, before it even gets to the site/js? (e.g., expose a secure input and output API (say, a new type of HTML textarea and markup tag). Whenever you start entering text, or when a secure element enters the viewport, look up the key for the site (stored locally, like how they remember passwords) and encrypt/decrypt the content. All the site/js sees is gibberish.
- rcxdude 12y agoYou will also need a mechanism for marking the input as secure which can't be duplicated by a malicious webpage.
- mike-cardwell 12y agoIt could. But it hasn't been done yet. And as rcxdude stated, it would need to be done in such a way that you can't create a fake secure textarea using HTML. Perhaps when focusing on one, all other script on the page stops, no events or timeouts are triggered, everything other than the secure textarea is ghosted out, and something big and obvious in the browsers chrome lights up to show you that you are actually focused on a "secure textarea" and not a normal one.
- derefr 12y agoThat sounds more like it should be a separate window/tab/sheet of browser chrome.