DEV Community

loading...

Discussion on: A Practical Guide to the Web Cryptography API

Collapse
adamcoster profile image
Adam Coster

That makes sense. So the key (user chosen password?) is only used client side? How do you handle forgotten passwords or lost keys?

Thread Thread
voraciousdev profile image
David R. Myers Author

So the key (user chosen password?) is only used client side?

Exactly. In this article, I just generated a new CryptoKey object, but it is totally possible to use deriveKey to create a CryptoKey object from something like a user-specified password (which makes way more sense in the real world).

How do you handle forgotten passwords or lost keys?

This is a great question, and it is the tradeoff for true privacy. There is no way to recover lost keys, because the keys are never transmitted to the server. This also means users cannot recover the encrypted data if they lose said key, because the data is never transmitted in plain text to the server. This is obviously a danger, and therefore it is typically opt-in for most applications. There are many other use-cases for client-side encryption, but the biggest appeal to me is the offering of choice to the user. If someone doesn't trust my server (or even their own browser) to store their plain text data, I absolutely understand and want to offer the best tools to help keep their data safe.