Max_P ,
@Max_P@lemmy.max-p.me avatar

HTTPS is already end to end encrypted. It's literally what it's for. TLS is everywhere: SMTP/IMAP (emails), even OpenVPN.

What about it are you trying to improve on? There ain't much you can do on a website, if the connection is intercepted then everything falls apart because the attacker already has the ability to modify whatever your server is sending, so any encryption you'd do in JS is compromised before it even runs.

If you can make an app, then you can do something called certificate pinning which effectively gives the client the public key of the server to expect. It guarantees that the client will only talk to the right server, and if that is broken, then literally everything is broken and nukes are probably about to get launched.

Most encryption uses the same primitives: RSA/ECDSA/DH to derive a stream cipher and then it's pretty much always AES these days, or sometimes ChaCha20, and usually SHA1 (broken) or SHA256 for message authentication.

E2EE makes senses when you're building say, a messaging app. There the E2EE is that the user's device holds the keys, so even the server can't see the message even as it stores it and sends it to the other device.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • random
  • webdev@programming.dev
  • test
  • worldmews
  • mews
  • All magazines