Skip to main content
Post Migrated Away to security.stackexchange.com by Zelda
Post Locked by CommunityBot
Post Closed as "off topic" by Zelda
Post Reopened by Zelda
Post Closed as "off topic" by ChrisF, dnbrv, Zelda
Source Link

Is client side encryption really better than server side?

Web application may encrypt all user data at client side to convince users that it can't decrypt them.

When user enters password, it's used to encrypt data and then it's sent to server in encrypted state. Server doesn't know password, encryption key and thus can't decrypt it.

But most of the users aren't able to review code used for encryption. All they can do is to trust it. Client side encryption may give feeling of control but:

  • Server can send one encryption code to one user and another one to the other
  • Government organization may urge server-side company so that it will disable encryption for certain users

So is there any benefit in client side encryption from user point of view?