this post was submitted on 19 Jan 2024
10 points (72.7% liked)
Web Development
3440 readers
12 users here now
Welcome to the web development community! This is a place to post, discuss, get help about, etc. anything related to web development
What is web development?
Web development is the process of creating websites or web applications
Rules/Guidelines
- Follow the programming.dev site rules
- Keep content related to web development
- If what you're posting relates to one of the related communities, crosspost it into there to help them grow
- If youre posting an article older than two years put the year it was made in brackets after the title
Related Communities
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
Wormhole
Some webdev blogs
Not sure what to post in here? Want some web development related things to read?
Heres a couple blogs that have web development related content
- https://frontendfoc.us/ - [RSS]
- https://wesbos.com/blog
- https://davidwalsh.name/ - [RSS]
- https://www.nngroup.com/articles/
- https://sia.codes/posts/ - [RSS]
- https://www.smashingmagazine.com/ - [RSS]
- https://www.bennadel.com/ - [RSS]
- https://web.dev/ - [RSS]
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
You're really kinda conflating a bunch of different problems here, so I think you need to focus down what you're really interested in accomplishing.
If you don't have access to HTTPS, you can maybe make something to fill that gap through JS, but it's gonna involve hijacking and re-implementing MOST of the functionality of the browser. There is almost certainly a more-effective solution to solve the lack of HTTPS.
I think the point you're trying to get at here is that the encrypted connection is only as secure as its endpoints. Traffic encrypted over HTTPS is no less "secure" in itself than traffic over a VPN, but the security ends at the HTTP server, and you may or may not trust the owner of that server to keep your data secure from outside parties. There really isn't any difference between an HTTP server and a VPN server in this context, except that VPN providers tend to care about privacy more than general-purpose web host providers, because that's kinda the selling point of VPNs for most people. A VPN provider could still be vulnerable to a legal request to collect and/or hand over data they have on you.
Sure, you're basically describing an E2EE messaging app, and this is different than HTTPS and VPNs, because the server sitting between two clients isn't an endpoint of the encryption, only the two clients are. Private keys are stored on client devices, public keys are exchanged, and all "data" moving out of the client is encrypted to be only decryptable by the client intended to receive it. The server doesn't have any of the private keys, so can't decrypt anything.
This is what HTTPS and VPN connections provide already.
In theory, you could accomplish this by delivering an initial payload of a mostly-empty HTML document, and some JS capable of bootstrapping an encrypted "connection" to the server, using only low-level browser network APIs. You likely wouldn't be able to encrypt most of the traffic, just the HTTP data payloads. Once the initial "connection" is established, then the server delivers the rest of the app itself, mainly JS SPA that renders everything locally.
In practice, you've basically just re-invented HTTPS, but worse.
And it's useless anyway because if the connection is unsafe, the script that does the client side encryption is already assumed compromised as well. It could be altered in transit to use a weak or known key. Or send back the keys to the attacker.