The problem here is that JavaScript encryption done in the browser is just plain insecure because you will always be prone to man in the middle attacks without HTTPS and if you are using HTTPS then you don't have to worry about this anyways.
People can always read JS and HTML and any other request that is coming/going to the server with MITM. Having a look at your patch instantly shows me this:
var key = CryptoJS.enc.Utf8.parse('8080808080808080');
var iv = CryptoJS.enc.Utf8.parse('8080808080808080');
This is pretty much all i need to decrypt the packet going to the server and now we're no better off than without HTTPS.
Regardless of how obscure you make this process, it is just security by obscurity. Even with a 'single use salt', you need to be able to request this single use salt - which will either be injected via HTML (readable) or in an http response (readable). In any case with MITM, this salt will be readable and because the key will also be readable, the packet can be decrypted.
So you can make a salt, you can make a configurable key, etc... but in all cases these values need to get to your JS one way or another and to do that means it's readable by MITM.
On another note... You can just fork the project on github and submit a pull request, that is how to contribute code to Umbraco core and its super easy, plus all code reviews can be done inline.
Client side encryption
Anyone interested in beta testing our client side encryption of Umbraco logins?
This IS NOT a replacement for SSL.
After seeing majority of Umbraco websites not using SSL we felt compelled to build a little security right out of the box for Umbraco.
Cheers,
David Dimmer
Fyin.com
LinkedIn
Hi David,
Where is the package you want tested ? Can't find it on the url you provided. Or maybe I overlooked.
Dave
Dave,
We were hoping to have a branch to link you to, but for now all we have is a patch file that needs to be applied against the Umbraco source.
Patch File v1.0: https://our.umbraco.org/forum/contributing-to-umbraco-cms/76646-client-side-encryption-on-umbraco-login
Our next patch file v1.1 will add a single use salt - to further enhance the security of non-SSL Umbraco websites.
-David Dimmer
The problem here is that JavaScript encryption done in the browser is just plain insecure because you will always be prone to man in the middle attacks without HTTPS and if you are using HTTPS then you don't have to worry about this anyways.
People can always read JS and HTML and any other request that is coming/going to the server with MITM. Having a look at your patch instantly shows me this:
This is pretty much all i need to decrypt the packet going to the server and now we're no better off than without HTTPS.
Regardless of how obscure you make this process, it is just security by obscurity. Even with a 'single use salt', you need to be able to request this single use salt - which will either be injected via HTML (readable) or in an http response (readable). In any case with MITM, this salt will be readable and because the key will also be readable, the packet can be decrypted.
So you can make a salt, you can make a configurable key, etc... but in all cases these values need to get to your JS one way or another and to do that means it's readable by MITM.
On another note... You can just fork the project on github and submit a pull request, that is how to contribute code to Umbraco core and its super easy, plus all code reviews can be done inline.
is working on a reply...