Welcome to HBH! If you had an account on hellboundhacker.org you will need to reset your password using the Lost Password system before you will be able to login.

A different way to tackle online encryption. Thoughts?


Mb0742's Avatar
Ultimate Headshot
0 0

So first let me say I realise this may not be practical but I want your opinions.

So lets say you are a bank, and as such you want all data over the wire encrypted so that even somebody listening on wireshark for example cannot intercept your files. An obvious solution is https here but lets say you wanted to be creative.

User A accesses Bank B

Bank B acknowledges that User A wishes to log in and takes note on what useragent is being submitted.

Bank B Sends a page with a javascript line which only produces error in said browser, along with session ID

user A, browser c doesn't respond well to [example error code] and responds with 867px instead of [css.style.element] (for example).

Using both the sessionID and the error output all code is encrypted into one key parameter and submitted over https.

Thoughts?


Arabian's Avatar
Member
0 0

That'd be cool, until the browsers update and then you lose your only form of encryption. What's wrong with some simple RSA?


Mb0742's Avatar
Ultimate Headshot
0 0

Well for fun. But agreed rsa is the way to go about it