Yes, it does happen on the server, and then the result of decryption (private data) is stored in the encrypted session that is available only when the client communicates with the backend.
Of course, as the owner of the system, I can always modify it to eventually get access to anything (when the user finally logs in).
I would be violating my own terms of service and privacy policy though by doing that and will be liable for this. And I don’t want that kind of liability on my shoulders.
Now, the client-side encryption is awesome! Especially, if you are dealing with power users or niche, where folks will overcome the initial UX struggles to start using the authentication key like this. In fact, certain bank systems allow you to log in only if you use a separate private key file on a special crypto-device that you have to connect to your computer.
And for banks or other crucial systems, and especially in B2B and for enterprises, that might work.
For the B2C software that’s going to be a huge block preventing people from using your product, unfortunately… Especially, if the product, like FelloWage, relies on a lot of user sign-ups and data shared before it becomes valuable for other users.
For further actions, you may consider blocking this person and/or reporting abuse
We're a place where coders share, stay up-to-date and grow their careers.
Yes, it does happen on the server, and then the result of decryption (private data) is stored in the encrypted session that is available only when the client communicates with the backend.
Of course, as the owner of the system, I can always modify it to eventually get access to anything (when the user finally logs in).
I would be violating my own terms of service and privacy policy though by doing that and will be liable for this. And I don’t want that kind of liability on my shoulders.
Now, the client-side encryption is awesome! Especially, if you are dealing with power users or niche, where folks will overcome the initial UX struggles to start using the authentication key like this. In fact, certain bank systems allow you to log in only if you use a separate private key file on a special crypto-device that you have to connect to your computer.
And for banks or other crucial systems, and especially in B2B and for enterprises, that might work.
For the B2C software that’s going to be a huge block preventing people from using your product, unfortunately… Especially, if the product, like FelloWage, relies on a lot of user sign-ups and data shared before it becomes valuable for other users.