The leaking of information by Edward Snowden has helped increased awareness of privacy, but unfortunately most people do not know how to securely store their own data. I have seen people storing extremely sensitive data within WordPress installations and assuming everything is fine since they used a "private page" or placed a password on it. But even though WordPress provides private and password protected pages, these still leave your data open to spying at both the server level and whilst in transit. Even if your server is locked down and secure, and you route the data over https, a man in the middle attack could still be used to gain access to your data.
The only true solution to securing your data within WordPress, is through the use of end to end encryption. The End to end encryption plugin for WordPress is my attempt to help alleviate this problem within the WordPress sphere and perhaps increase the prevalence of secure data storage across the interwebz.
These guys are after your data! End to end encryption maybe the only way to stop them.
The trick to ensuring true end to end encryption within WordPress, is to encrypt your posts before they are sent back to the server and only decrypt them once they arrive back at browser level. This means that there is no point of failure outside of the computers being used to access the web pages.
Even if the server is hacked, the only thing which could be obtained is a blob of encrypted data. To access the content, either your computer would need to be hacked or you would need to be forced to hand over the encryption key. With the End to end plugin, not even your WordPress installation will be able to decrypt your content, due to it's use of true end to end encryption.
The big downside to end to end encryption, is that you need to provide the encryption keys every time you want to access the content. I may be able to implement encryption key storage via browser offline storage in future, but I haven't implemented it yet.
You will not be able to perform server side searching with encrypted posts. Since the content is encrypted, WordPress has no way to search through it. Front-end searching is technically possible, but not practically feasible due to the need to download every page on your site before searching.
The normal filters on WordPress content can not be applied (since WordPress can't read the content anyway). So things like paragraph tags and line breaks need to be manually added. The content you put into the WordPress editor will be read as raw HTML. Any extra content added by plugins will also not work on encrypted posts, including many plugins which add things like social sharing icons (since most of them work by filtering the post content).
The encryption used within the end to end WordPress plugin, is the simple but highly effective AES style encryption provided by Chris Veness. AES is a powerful encryption algorithm based on the Rijndael cipher. This is the exact same cipher used and recommended by many government agencies for top secret data storage and is considered the industry standard for storing extremely sensitive data.
Joan Daemen and Vincent Rijmen, the two Belgian cryptographers who developed the Rijndael cipher, which AES is based on.
To learn more about AES symmetric ciphers, check out Symmetric Ciphers from Leo Laporte and Steve Gibson. To ensure maximal security, it is recommended that use a complex encryption key. Head on over to Steve Gibson's password haystacks page to help find a suitable password/encryption key.
There is nothing particularly innovative about this WordPress plugin, but it is intended as a way to drop the barrier of entry for those wanting to properly encrypt their own content online. I've seen plenty of other tools which claim to protect your data through encryption, but these almost always have failures in some ways. The recent case of the USA authorities compelling Ladar Levison to hand over the SSL keys for the Lavabit email service is a prime example of the problems associated with attempting to secure content with true end to end encryption in place.
I'm not guaranteeing anything with this plugin! To the best of my knowledge, the cipher is secure and in principle I believe there is no way to access your data without you sending data in the clear. There are some bugs in the current implementation which can cause you to send unencrypted data if you aren't careful. This plugin is here as a proof of concept at this stage and is definitely not intended to be trusted for securing highly sensitive data.
Note: This is a beta and contains some known issues (see below) which will be fixed shortly.
Download the End to end plugin beta, install it in your WordPress site and activate it.
There will be an encryption key input field above "Publish" when editing a post. If a key is set, then encryption will be applied and you will be prompted to re-enter it to view the content again.
It is critical to ensure that you do not forget the keys. If you forget them, you will never be able to recover the content (which is the point of this plugin – it should be uncrackable).
Note: Since this is true end-to-end encryption, you will be required to enter this EVERY time you access this content.
Showing the editing page when using the End to end WordPress plugin.
Click "Preview" can result in unexpected behaviours. Future versions will fix this problem.
If someone can see your screen, then they could work out what keys you are pressing by reversing the encryption for each keystroke.
https via regular certificate providers is known to be cracked by various governments, including the Five Eyes. To avoid this issue, it is best to use a self-signed certificate with the certificate manually added to your web browser.
Personally, I'm not paranoid enough to require that much protection just yet, but it may be a suitable project for the future perhaps. If anyone would like to tackle it, I'm super keen to work together on it.
I've put up a demo at geek.hellyer.kiwi/encryption-demo. The encryption key for this demo is "test" (but you should never use a key which is this short, I just did it this time since it is here for demo purposes).
I have been storing my own sensitive data in a pseudo-secure way for a long time now and after listening to many episodes of the Security Now podcast by Steve Gibson and Leo Laporte over the past few years, I decided it was time I found a solution to my problems. The End to end encryption plugin now allows me to store anything I like within my WordPress installation without fear that evil doers may be snooping in.
Security Now! with Leo Laporte and Steve Gibson. An excellent resource for learning about how to keep your data secure online.
I'm working on it right now 🙂 It had WAYYY too many bugs, so needed quite a bit of work. I found another bug about two minutes ago too. If you try to use the visual editor in WordPress, it breaks it, which would be okay since you would see it's broken, but if you decrypt an old message, then flick to the visual editor and hit "Update", it actually sends your decrypted message back to the server … poop.
Sorry Ryan, I'd love to help but I'm committed to too many projects right now as it is and I don't want to start giving false promises. Good luck tho man – great cause!
isn't HTTPS supposed to protect against man in the middle attacks if it's correctly configured?
https offers protection from client to server. This plugin is attempting to provide protection from client to server, then back to client.
I forgot to mention one other problem with https … if someone has access to the root certificate, then they can decrypt ALL of your traffic, making https kinda useless. It has already been revealed that the NSA has been obtaining expired certificates, which can be used to retrospectively decrypt content even after the certificate has long since expired and is no longer in use.
I'm very interested in this plugin and wanted to know how it was progressing?
Does this plugin have the potential to be customized to encrypt specific user details (username, profile information, messages) in the wordpress database, rather than posts?
Ideally would the following be a possible way to deal with the decrypting?
For each user of your site, encrypt the CP and save it in a small file. Use that user's own web site access password as the password to decrypt their own version of the encrypted CP.
You couldn't use their regular password, as that would be sent back to the server to log you in each time. This plugin could be adapted to encrypt just about anything so long as it isn't something WordPress needs to analyse internally (usernames for example are used by WordPress itself).
Defining a single password would be nice, but you would either need to constantly enter that password, or find some way via cookies, offline storage or best of all, via a browser plugin to handle it.
I have one more addition I want to add to the plugin and that is preventing it from decrypting the content live whilst you watch it, and instead waiting until you hit a "decrypt" button. This is to prevent anyone watching you, from being able to work out what keys you pressed based on the iterative decryption which occurs now.
My attempts to figure out how to do this as a browser plugin failed and I haven't had any offers to help, so at the moment, that side of it is on hold.
The only way I can think of to work around this issue, is through the use of a browser plugin.
Good point, yes, you\\\'re right.
At the end: if paranoia is on its way there is no way out. Even a browser extension could be hacked. If you place the processing JS there then the attackers interest also moves there.
Maybe it\\\'s better to think about an independently working security suite that checks file checksums by a servers cron job, like rkhunter.
You can manually go through and check the code in a browser plugin though, you can't do that with a website (unless you audit the code every time you load a page).
An independent server can be hacked just as easily as the original one, so that won't help.
It is also much harder to attach via a browser plugin, since the update mechanism for the browser plugin would presumably send an email when a change was made (like WordPress does with plugins).
As soon as bad code was deployed, you would be notified about it.
However, thanks for this plugin so far!
I am much more interested in a way to encrypt member data in the WordPress database.
The risk of MIM attacks is pretty small. The valuable data is in the mysql database, which is far easier to attack than performing a MIMA.
This plugin isn't only for man in the middle attacks, it also stops attacks on the server. Even if you have encrypted the data in the DB, if you have left the keys for it on the server, then as soon as the server is compromised so is your DB no matter whether it is encrypted or not. And even if you enter the keys in the browser to decrypt each time, those could be stolen once they reach the server (if it is compromised).
What you described would be a completely different plugin since it wouldn't featured encryption from end to end. I remember seeing a lot of plugins out there when I was researching this one that did exactly that. They possibly have some uses, but you certainly wouldn't want to go storing extremely sensitive data in there since it wouldn't be totally secure.
That is technically possible, and I would love to do it, but there are a lot of problems involved.
For it to be true end-to-end encryption, the file would need to be encrypted in the browser, then sent back to the site as an anonymous data blob, then decrypted as an anonymous blob in the browser when viewing it, and turned back into an image.
Very interesting plugin Ryan. I am going to experiment with it directly .
We need your solution combined with Gravity Forms developed forms. Will there be a integration/solution for this?
Hi Peter. That would need to be custom built and require quite a bit of work.
I am available for paid jobs if you need assistance with this.