5 ms·
You forget one case: Here, the server will never know the content of the encrypted data.
by maaaats 12y ago
You forget one case: Here, the server will never know the content of the encrypted data.
- detaro 12y agoUnless it is the one delivering you faulty javascript. It does help if someone gets only read access to the server though (hacked user account, stolen backup, confiscated server...)
- new299 12y agoUnless the attacker has access to the server for a period of time, in which case they just replace the JS with their own code. Seems like there should be a way to sign the JS offline (away from the server) and prevent that, but I don't think there's any browser mechanism for that. I think that would be neat though.