Is JavaScript encryption still secure ?

Click For Summary

Discussion Overview

The discussion centers around the security of JavaScrypt, an encryption program, and its effectiveness in protecting sensitive information such as passwords. Participants explore the implications of using JavaScript for encryption, the nature of security beyond encryption, and the adequacy of JavaScrypt compared to other encryption methods.

Discussion Character

  • Debate/contested
  • Technical explanation
  • Conceptual clarification

Main Points Raised

  • Some participants assert that while JavaScrypt may provide a level of encryption, its security is contingent on various factors, including the complexity of the password used.
  • Others argue that encryption alone is insufficient for overall security, emphasizing the need for multiple layers of protection.
  • A participant highlights that JavaScrypt's encryption strength appears comparable to online banking standards (256-bit encryption), but questions remain about its practical security against sophisticated attacks.
  • Concerns are raised about the misunderstanding of how encrypted passwords function, particularly regarding one-way encryption and the importance of secure password storage practices.
  • Some participants recommend using established methods like bcrypt for password storage instead of relying on JavaScript-based encryption due to potential vulnerabilities in client-side execution.
  • Questions are posed regarding the specific goals of using JavaScrypt and the threat model being considered, indicating a need for clarity on the intended use case.

Areas of Agreement / Disagreement

Participants express differing views on the security of JavaScrypt and the appropriateness of using JavaScript for encryption. There is no consensus on whether JavaScrypt is a secure method of encryption, and the discussion remains unresolved regarding its effectiveness compared to other encryption techniques.

Contextual Notes

Limitations include the lack of clarity on the specific security measures in place when using JavaScrypt, the dependence on user-defined passwords, and the unresolved nature of how JavaScrypt compares to other encryption standards.

Who May Find This Useful

This discussion may be of interest to individuals concerned with data security, particularly those exploring encryption methods for password storage and the implications of using JavaScript in security applications.

B0b-A
Messages
155
Reaction score
32
JavaScrypt is an encryption program [ 256AES ?] released in 2005 ...

http://www.fourmilab.ch/javascrypt/javascrypt.html

Is this still a secure method of encryption ? ,
an example of an encrypted messages is below, [ the key is a 64 character hexadecimal number ]

##### Encrypted: decrypt with www.fourmilab.ch/javascrypt/javascrypt.html
?HX?98173c79973dccf051f1820b34726b6d9309124671568aa911bdef6e4b56
541e115a49f22a113e5eea288546f761e8350aead00d3efbe1ff45a37d011f25
5c3108214f785801a833bac2eb456af324c957741c2d99180ac5e1d1e1febaf1
bded?H
##### End encrypted message

A bruteforce crack allegedly would take trillions of centuries ... https://www.grc.com/haystack.htm
 
Last edited:
Technology news on Phys.org
The short, and probably not what you want, answer: Yes but it depends.

Important points:
1. Security is NOT encryption. Encryption is a small part of overall security. Security is very multi-faceted, and depends on lots of layers to be effective.
2. Do not confuse time to decrypt with anything more than a means to scare off the script kiddie attacks. Time to decrypt simply forces some wannabe hacker to go on to another site, for example.
3. If you expect encryption alone to deter a well-funded government agency from most countries, think again.

Plus:
The site you link to about bruteforce attack, explains the other depends. If you have an 8 byte, diverse character-space password the straight bruteforce attack duration is determined by the number of characters. 16 bytes takes longer to bruteforce. The idea behind the website - make your password secure enough so the bad guys will go away, and choose some very easily hackable system.Before you entrust your life's savings to some encryption based security scheme go to Bruce Schnier's site. He has a bunch of articles.

http://www.schneier.com/about.html

IT Management, usually non-technical folks, ask questions like this all the time. So you asked a good question, keep working on it.
 
Last edited:
jim mcnamara said:
3. If you expect encryption alone to deter a well-funded government agency from most countries, think again.

Plus:
The site you link to about bruteforce attack, explains the other depends. If you have an 8 byte, diverse character-space password the straight bruteforce attack duration is determined by the number of characters.


I was looking for a method to store encrypted passwords in away that could be decrypted on any computer OS, (Windows/Linux/Mac), and JavaScrypt seemed to offer that, provided it had an internet browser with JavaScript. The encryption need only be sufficient enough to prevent criminal element from helping themselves to my bank account, rather than defeat the FBI.

Online banking uses 256bit encryption , so on the face of it JavaScrypt (AES256) appears to be as least as strong for the same key length.

BTW the key for the encrypted message in the first post is the hexadecimal number (not “text”) below … 1BF5427B1DEB40557B05276D27CC801DD9C500D87441C8B7DF159575D2D851D0
 
Last edited:
Basic misunderstand is going on here. "Encrypted passwords" are never unencrypted. They are encrypted with one-way encryption the first time the password is entered, then the encrypted form is stored. This is so that people cannot just break into the password database and steal your password. (It's actually more complex than that, as passwords get "salted" as well as encrypted--Google it).

To use an encrypted password, you need to have the same one-way encryption algorithm, encrypt the received password (which should have come to you via an already-secure transmission medium), and then retrieve the encrypted STORED password and compared the just-encrypted recently-entered password.

I have no idea whether JavaScrypt software does a good job of this or not, but was concerned about the phrase "in a way that could be decrypted" because it indicates a basic misunderstanding of how encrypted passwords need to be handled.
 
If you're storing passwords, use something like bcrypt.

Using JavaScript (the language) for encryption is generally frowned upon in the security community (though there is some argument on this point). Browsers are generally insecure and it's too easy to modify code that is run on the client.

What exactly do you hope to accomplish, and what is your threat model?
 
Last edited:

Similar threads

Is Unbreakable Encryption Truly Possible?
  • · Replies 9 ·
Replies
9
Views
3K