3 ms·
I assume that you're doing client side encryption here right? To try and guarantee that the Javascript you are delivering is from your server and not MITMed 'b
by junto 11y ago
I assume that you're doing client side encryption here right?
To try and guarantee that the Javascript you are delivering is from your server and not MITMed 'by the man', doesn't everything need to be over TLS/SSL and certificate pinning needs to be in place?
I'm no security expert, but there are plenty around who can confirm or deny that.
Edit: The password is being sent in a POST without any encryption to protect that request, or am I missing something?
- liamnewman 11y agoEncryption is server side. Your file is uploaded, encrypted, then deleted.
- junto 11y agoBut the password and file are sent over the wire without any protection?
- liamnewman 11y agoAlso, I should state that I am getting SSL working atm.
- junto 11y agoIf you need free just to get it working I think Cloudflare offer that: https://www.cloudflare.com/ssl https://www.cloudflare.com/ssl StartSSL as well.