security - Data Encryption With breeze -
make quick: going publish our web site soon, our task provide live scores, , paying money live result fast possible.
we not force user log-in see latest result, don't calling url , result our web site
currently using breeze , happy , it's functionality ((hello ward)) want encrypt data on server , decrypt on client. know it's not efficient it's enough (just makes hard) , know can use hand made js handle situation, lost breeze + knockout functionality if encrypt server response (json) , other thing can encrypt data (column column) not killing me encrypt on server , decrypt on client (i hope not in bio-direction)
i'm looking cleaner hide complication , allow me not think it.
(in nutshell: not bank, when hit url: xxxxx/breeze/api/soccer not human readable result (and 1 step head of base64, don't call encryption or security))
if understand correctly, want hits raw api believe data encrypted. client app know better , "decrypt" readable form.
i don't have js library simulating crypto. can find on web (checkout crypto-js). if had one, , wanted unobtrusive possible client developer ... essence of question think ... put "decrypt" inside my custom jsonresultsadapter. that's easy place morph incoming data bits before app sees them.
it's different question if want "encrypt" them save. think said not issue @ moment.
you realize exercise in security-through-obscurity. if enough, carry on. if need real confidentiality, forget in pure javascript. cannot serious encryption in browser javascript today. don't believe tells otherwise (see "javascript cryptography considered harmful"). appropriate thing require authentication , use https beginning end. security gurus tell me.
Comments
Post a Comment