Description:
------------
---
From manual page: http://www.php.net/function.openssl-decrypt
---

Comment from user "nbari at dalmp dot com" is proposing to send critical data over an insecure channel (http) by using a javascript library.

I wanted to answer, but seeing and respecting your rules ("this is not a forum", http://php.net/manual/add-note.php?sect=function.openssl-decrypt&redirect=http://php.net/manual/en/function.openssl-decrypt.php#whatnottoenter) I did not post.

Howewer, I think this post is not accurate enough (what are the risks) and might lead to unsafe usage (we are not all cryptographers / security experts...)

The code/description problems are the following to my eyes:
1) Suggests using a non-secure channel (http) can be secure. Or at least does not explicitly states that the proposed solution is NOT secure. Obfuscation is not considered secure by anyone.

2) suggests sending the obfuscated key over the unsecure layer. It is recomputed on the server side. Then if the code is known, the "cipher" can be easily decoded (code/decode is more accurate than encipher/decipher in this case, IMHO).

3) It should be state that it is easy to get the key by reading the javascript source code (trivial) if no other mechanism is in place...

Conclusion: this post can lead to unsecure behaviors...

I love the user documentation, but here I was very surprised...


Test script:
---------------
Nothing to test...