不使用JavaScript加密PIN

Question

This is our dilemma. We have an app that uses JavaScript to encrypt an entered PIN value. The risk here is the encryption is exposed to the public. Although it is secured because it uses asymmetric key encryption, it is still susceptible to a brute force attack. Something like attacker entering PIN values as trial and error, encrypting it then submitting the request. So as not to allow an attacker to get hold of the encryption logic, we need another way to hide this. Moving the encryption logic to the back end would allow the PIN to be exposed during submission (eg can be seen by browser request interceptors).

Is there any solution to this?

Answer 1

Never put your encryption on the client side, you need to do back-end encryption or your logic will get compromised.

Always use HTTPS when you are transfering sensitive information to protect it from 3rd-party.