Encrypt user password using jquery and decrypt it using C #

Question

• I do not want to use SSL to encrypt the registration and signing forms for the website I am creating.
  • I have no money to pay for the certificate.
  • I need to use encryption with jquery and decryption using C # on my asp.net website.

Does anyone have an example and how safe is it to adopt this method?

Answer 1

If you do not use SSL, you are insecure, but this is not the only reason.

SSL protects the actual connection, while encryption protects the data that you connect. You do not even have to encrypt passwords. You have to make a strengthened hash of information. A hash is a one-way function (cannot be canceled), while encryption is a two-way function (can be canceled). Storage and use of hashing includes:

• Iterating over a hash built for speed, like SHA512 couple of thousand times, or using something like BCrypt .
• Use salt - something like a 64-bit array of riots per user stored in the database will do this
• Encrypt keys and salts in the database using the key in the application layer. This means that if your database is taken, they still need a key from the application layer to access the original hash information, as well as the salts.

You must remember that security is built in layers. By skipping SSL, you will skip most of it. At the very least, you can use makecert to create a self-signed certificate . All that happens is that the user will be warned about this. A good SSL certificate can only cost $ 12.99 on GoDaddy . I recommend getting it, as well as implementing the above.

Answer 2

You can do SSL without paying a certificate, and this method will allow you to protect only the browser so that it is not possible to obtain information about your certificate.

Read about it http://www.akadia.com/services/ssh_test_certificate.html

Answer 3

He is probably not protected at all. SSL is really the way to go; if you cannot afford a certificate, you can always make your own. Obviously, they will not check up to one of the trusted root resources, but they are just as secure - the identity of your site will not be verified by a trusted third party, but the connection itself will also be securely encrypted.

Answer 4

Without SSL, you open your code for network sniffing attacks. Client-side encryption is also not good.

Unfortunately, there is no safe way around it without obtaining a valid certificate. This approach would be unsafe.

Answer 5

I agree with other people's security considerations, if you are so successful at this, you can try using the PKI user interface. You will need to study a little deeper the code necessary to achieve this, but here is a link to describe the structure of the public key:

Public Key Cryptography

So, if you manage to encode the RSA algorithm with the public key in jQuery, you will not have to easily match its decryption of the secret key in C #. This is not a recommendation, because in reality it is only “security through obfuscation” (which is not security at all).

Answer 6

You can encrypt form data using Javascript. This can be done, see http://www.movable-type.co.uk/scripts/aes.html . If the data is encrypted using a key, you will have to save this key in javascript code, as well as in server code. Since javascript code will be on the client side and the key will be publicly available, this will not be safe :). The same is true for asymmetric encryption. Different data can be encrypted with the same key and sent to the server.

SSL is designed to solve Internet security problems using public-key cryptography and symmetric encryption technology. The attack of the average person is not allowed. Using SSL, you can be sure that your data is protected, not changed, and there is a third-party certification authority that says that you are who you are.

If you say that I can put the encryption key or code in the applet or active-x object or flash swf and use obfuscation to protect the code, this might be the way. But again, this approach is open to attack and not protected. Obfuscation does not guarantee that your key or algorithm is safe, it just hardens the work of the cracker to get the key.

I hope this helps.

Answer 7

You can use HMAC for authentication. This would not ensure privacy, but the sniffer (the guy looking at the network traffic then) could not get the passwords and username representing the real user. When I do not provide privacy, I mean that the sniffer will see all the transferred content, but not the password.

SSL is, of course, very secure, but a redundancy for many applications.