Re: NSRG-Security SaS Encryption cracked

[Valdis.Kletnieks () vt edu]

On Wed, 15 Oct 2003 01:55:10 CDT, Paul Tinsley <pdt () jackhammer org>  said:

>     full-disclosure it inspired me to audit a few websites myself.  I started
>     with the author of all the IMHO frivolous postings and found that he
>     "encrypted" his website with something called SaS that his group wrote.

Since the transmitted HTML needs to be (eventually) interpreted as HTML, there
are only two basic options:

1) Settle for mere obfuscation and a snippet of reverse-engineerable Javascript
or similar that decodes the obfuscated input to HTML that the browser will
accept.

2) Use a public-key or shared-secret system wherein each client gets a
potentially different version of the page (note that this includes the case of
an HTTP authentication failing and giving you an error page).

Again, to repeat - without some sort of per-client unique key, all you can do
is obfuscate, and said obfuscation has to be done in a programmable reversible
way to be at all useful.

Attachment: _bin
Description: