note 108993 added to function.openssl-decrypt

A question on using GibberishAES over an insecure channel: Suppose we implement a Diffie-Hellman exchange to establish a shared key, instead of just putting the key in javascript; what keeps our Man in the Middle from serving a version of GibberishAES that implements the API but does no encryption? Even serving just the GibberishAES code via https is easily circumvented by replacing the https url in my original page with a http one. I can try to obfuscate my use of GibberishAES but I'm just entering an arms-race then. Bottom line is: How can I get a trusted version of GibberishAES on the client over http? ---- Server IP: 69.147.83.197 Probable Submitter: 192.16.191.88 ---- Manual Page -- http://www.php.net/manual/en/function.openssl-decrypt.php Edit -- https://master.php.net/note/edit/108993 Del: integrated -- https://master.php.net/note/delete/108993/integrated Del: useless -- https://master.php.net/note/delete/108993/useless Del: bad code -- https://master.php.net/note/delete/108993/bad+code Del: spam -- https://master.php.net/note/delete/108993/spam Del: non-english -- https://master.php.net/note/delete/108993/non-english Del: in docs -- https://master.php.net/note/delete/108993/in+docs Del: other reasons-- https://master.php.net/note/delete/108993 Reject -- https://master.php.net/note/reject/108993 Search -- https://master.php.net/manage/user-notes.php