Is a Secured (Web) App Possible?
summary
Explains a practical Zero Knowledge Architecture that uses a client master password derived key to generate an intermediate certificate and two key pairs (auth + encryption), stores public keys on the server and private keys client-side, and performs ZK-proof auth via signed random tokens; shares data with per-blob per-blob symmetric key encryption where each symmetric key is encrypted to the recipient and can carry an expiration token; recommends libsodium, WebAssembly for crypto (web assembly sandbox), Standard File backend, Signal protocol ideas, and Shamir-style recovery with TOTP.
AI-written summary · about
chapters (9)
- 0:00Introduction to web app security
- 1:51Zero knowledge architecture basics
- 7:13Zero knowledge proof authentication
- 13:56End-to-end encryption workflow
- 20:20Non-native data approach
- 25:19Securing progressive web apps
- 33:08Migrating existing apps
- 39:56Who protects your data?
- 42:22Q&A session
related talks
38mZero Knowledge: you can't leak what you don't know
27mBuilding Zero-Knowledge Backends
44mZero Knowledge Architecture
28mDeveloping zero-knowledge solutions with JavaScript
45mZero Knowledge; Meeting the Growing Demand for Security and Privacy
39mZen and the art of edge authentication
28mPasswordless zero-knowledge services
50mBuilding Production-Grade End to End Encrypted App...