System and method for web-browser based end-to-end encrypted messaging and for securely implementing cryptography using client-side scripting in a web browser
A system and method for sending end-to-end encrypted messages comprising a sender's web browser, a recipient's web browser, and a server. The system and method avoid both the sender and the recipient having to download encryption programs themselves onto their respective computers. In addition, the system and method ensure that unencrypted messages are never disclosed to the server. The system and method operate by first downloading the web browser files, verifying them and then preventing the web browser page from refreshing, thereby preventing malicious code from entering the web browser each time the web browser page would normally be refreshed. The system and method also provide for securely implementing cryptography using client-side scripting in a web browser.
1. A method of encrypting a message using a web browser comprising the steps of:
running said web browser on a user's computing device;
downloading, by said web browser, client-side scripting from an untrusted first server operated by a first provider;
verifying, by said web browser, integrity of said client-side scripting in conjunction with a cryptographic hash obtained from a second server, operated by a second provider, trusted by the user; and
executing, by said web browser, said client-side scripting to encrypt said message only upon success of said verification.
2. A method of decrypting an encrypted message using a web browser comprising the steps of:
running said web browser on a user's computing device;
downloading, by said web browser, client-side scripting from an untrusted first server operated by a first provider;
verifying, by said web browser, integrity of said client-side scripting in conjunction with a cryptographic hash obtained from a second server, operated by a second provider, trusted by the user; and
executing, by said web browser, said client-side scripting to decrypt said encrypted message only upon success of said verification.