Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>For logging in you could try <a href="http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol" rel="nofollow">SRP</a> from <a href="http://www.clipperz.com/open_source/javascript_crypto_library" rel="nofollow">clipperz</a>: </p> <ul> <li>I'm not sure how strong the random number generator they use is. You might want to try and use the <a href="http://wiki.whatwg.org/wiki/Crypto" rel="nofollow">Crypto API</a> to get stronger values. I'm not sure how you can get secure seed values in javascript without using Crypto API. </li> </ul> <p>For sending initial password to server you could use public key encryption. So the server sends the client its public key (ok under the no mitm assumption) and the client encrypts the whole registration request when registering. Cipperz has support for public key encryption but in a very raw form. Often you use public key encryption to encrypt a randomly generated symmetric key and use the symmetric key to encrypt the payload. You have to be quite careful with <a href="http://en.wikipedia.org/wiki/RSA_%28algorithm%29#Padding_schemes" rel="nofollow">padding</a>/etc to make public encryption properly secure. I don't know of any robust public key crypto libraries for javascript.</p> <p>You may want to check out <a href="https://github.com/jasondavies/jsbn" rel="nofollow">jsbn</a> for public key encryption because it looks like it does padding correctly. Though, I suspect it suffers from insecure random number generation. It would be a good idea to use Crypto API or make the user bang the keyboard to generate some entropy. Snippet from rng.js</p> <pre><code>// For best results, put code like // &lt;body onClick='rng_seed_time();' onKeyPress='rng_seed_time();'&gt; // in your main HTML document. </code></pre>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload