[ProfessorChill]

It hasn't been updated since 2013, is it still okay to use CryptoJS.AES???
I mean it's going CryptoJS to openssl_encode on php so it should be fine?

Just a very short question :I

[Pikami]

I have read somewhere that a new maintainer should take over the development, but I didn't see any updates.
Is it still safe? IDK, I still use it. I mean AES is still AES, it hasn't changed.

[Inori]

If the AES implementation was verified as cryptographically secure initially and hasn't been tampered with, I don't see why its status would change.

On a slightly unrelated note, are you encrypting browser-side or in backend with node or something? Because I really wouldn't recommend the former.

[ProfessorChill]

I have read somewhere that a new maintainer should take over the development, but I didn't see any updates.
Is it still safe? IDK, I still use it. I mean AES is still AES, it hasn't changed.

Hm, good point I mean it's just so that users feel more safe sending me information, I mean it's encrypted before it's saved anywhere but it still goes through a server so people could be afraid of the "possibility" of me being able to decrypt and read it.
So my plan is to do this:
Username -> server -> gets email
Password -> local machine -> encrypt via username and email -> password to server -> openssl_encrypt -> save to DB
That's just for registering that way it's dual encrypted and the server only sees the encrypted password and nothing else.

---

If the AES implementation was verified as cryptographically secure initially and hasn't been tampered with, I don't see why its status would change.

On a slightly unrelated note, are you encrypting browser-side or in backend with node or something? Because I really wouldn't recommend the former.

Sorry, please read one message above.

[Pikami]

I have read somewhere that a new maintainer should take over the development, but I didn't see any updates.
Is it still safe? IDK, I still use it. I mean AES is still AES, it hasn't changed.

Hm, good point I mean it's just so that users feel more safe sending me information, I mean it's encrypted before it's saved anywhere but it still goes through a server so people could be afraid of the "possibility" of me being able to decrypt and read it.
So my plan is to do this:
Username -> server -> gets email
Password -> local machine -> encrypt via username and email -> password to server -> openssl_encrypt -> save to DB
That's just for registering that way it's dual encrypted and the server only sees the encrypted password and nothing else.

---

I see why you would want to do this. The most important thing is that SSL should be correctly configured to avoid anyone else from sniffing the password.
+ Remember this, while the password of the user is encrypted, if an attacker gets that piece of encrypted text, they don't need a password to login to that user, they just need the encrypted password

[Inori]

Hm, good point I mean it's just so that users feel more safe sending me information, I mean it's encrypted before it's saved anywhere but it still goes through a server so people could be afraid of the "possibility" of me being able to decrypt and read it.
So my plan is to do this:
Username -> server -> gets email
Password -> local machine -> encrypt via username and email -> password to server -> openssl_encrypt -> save to DB
That's just for registering that way it's dual encrypted and the server only sees the encrypted password and nothing else.

I'm a bit confused as to why you would bother with all the extra steps and memory overhead when you could just use OpenSSL on your server and not have to think about it. If it's a matter of reassuring users, it should be enough to satisfy anyone that isn't a crazy conspiracy theorist.

As well, if your users are worried about you reading it, bcrypt the data you receive even if it's already protected by SSL.

[ProfessorChill]

I have read somewhere that a new maintainer should take over the development, but I didn't see any updates.
Is it still safe? IDK, I still use it. I mean AES is still AES, it hasn't changed.

Hm, good point I mean it's just so that users feel more safe sending me information, I mean it's encrypted before it's saved anywhere but it still goes through a server so people could be afraid of the "possibility" of me being able to decrypt and read it.
So my plan is to do this:
Username -> server -> gets email
Password -> local machine -> encrypt via username and email -> password to server -> openssl_encrypt -> save to DB
That's just for registering that way it's dual encrypted and the server only sees the encrypted password and nothing else.

---

I see why you would want to do this. The most important thing is that SSL should be correctly configured to avoid anyone else from sniffing the password.
+ Remember this, while the password of the user is encrypted, if an attacker gets that piece of encrypted text, they don't need a password to login to that user, they just need the encrypted password

Hm, I never thought about sniffing. That is a good point. And yeah, I was just thinking about that. but to be honest that's on my side and on the firewalls side which I don't think my projects would get that large :I
If someone gets to the MySQL I'm sure I would need to do some other key measures to prevent hacking.

Hm, good point I mean it's just so that users feel more safe sending me information, I mean it's encrypted before it's saved anywhere but it still goes through a server so people could be afraid of the "possibility" of me being able to decrypt and read it.
So my plan is to do this:
Username -> server -> gets email
Password -> local machine -> encrypt via username and email -> password to server -> openssl_encrypt -> save to DB
That's just for registering that way it's dual encrypted and the server only sees the encrypted password and nothing else.

I'm a bit confused as to why you would bother with all the extra steps and memory overhead when you could just use OpenSSL on your server and not have to think about it. If it's a matter of reassuring users, it should be enough to satisfy anyone that isn't a crazy conspiracy theorist.

As well, if your users are worried about you reading it, bcrypt the data you receive even if it's already protected by SSL.

I was using just OpenSSL however it was a complaint a user sent me that the server sees his password in plain text (despite having logging off) I will however look into bcrypt, I've never heard of that.