Click here to Skip to main content
15,891,976 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Hi..
Is there any way where i can do the encryption while input values in a textbox??
I need to do Password encryption in client side and then have to store different encrypted value in the database for secure auditing.. Please help me out with this..
Posted

You could but it is useless.
Let's assume, you do it. First of all, you should encrypt the value of the filed only when it's not changed anymore, most algorithms won't tolerate this while you type. You could however encrypt the value using a javascript event handler just before the form is posted.
But haven't you wondered why this is not used? Because if you want to encrypt on client side, you need to have all logic and keys on client side, you need to send (when we speak of web) all logic and keys to the client side. If one can capture the encrypted text when travelling over http, that one can also capture the logic and keys also. Still, if you want to, just use a library like this: https://github.com/travist/jsencrypt[^].
So you better encrypt the communication, by using https.

On the other hand storing passwords in an encrypted form is a good practice. But not the best, you should not store passwords at all. You should be able to compare passwords but without knowing the password itself. How to do that? By using a good hash algorithm, and some "salt". This is a really good description of how to proceed: https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet[^]. This is also a good lecture: http://www.captechconsulting.com/blog/kevin-hazzard/best-practices-managing-customer-passwords[^]

I hope you will succeed in your project.
 
Share this answer
 
v2
Comments
Sam Ferin 19-Aug-14 4:59am    
Hi,

So could you please suggest the best way to avoid such things?? because if we do the normal encryption,the passwords are going as a plain text until it reaches the server..

Regards,
Sam Ferin S
Zoltán Zörgő 19-Aug-14 5:06am    
If you don't encrypt, the password is travelling as plain text inside the http request, but if you use https, the whole communication is encrypted. You could however implement a https like infrastructure above http just to properly encypt only the password. But I think that is a huge amount of work for nothing.
Still, you have to keep in mind, that ssl is expensive in terms of server resources - so you can combine https with http to have ssl only where it is really needed. But there are things to care of in case of such mixed case.
In addition, if you want to have a trustworthy https, you can't use self-signed certificate (see also: EVC).
Sam Ferin 21-Aug-14 2:20am    
Thanks for your reply... We planned to go for https protocol ,since we need that for other issues also...

Regards,
Sam Ferin S
Please refer my recent answer. It will be useful for you : Encrypt and decrypt data using symmetric key cryptography[^]

Regards..
 
Share this answer
 
Comments
Sam Ferin 19-Aug-14 3:24am    
Hi Rohan..
Thanks for your reply. But i should not send the password in plain text or encrypted format to the server,because the password can be captured using traffic monitoring.. Is therre any other way using script to encode it while typing the values in a password textbox??

Regards,
Sam Ferin S

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900