Also of note:<p>* <a href="https://crypton.io/" rel="nofollow">https://crypton.io/</a> a zero-knowledge web framework from SpiderOak<p>* <a href="http://hails.scs.stanford.edu/" rel="nofollow">http://hails.scs.stanford.edu/</a> a secure web platform framework for untrusted 3rd party plugins
From the blurb:<p>Mylar protects data confidentiality even when an attacker gets full access to servers. Mylar stores only encrypted data on the server, and decrypts data only in users' browsers. Simply encrypting each user's data with a user key does not suffice, and Mylar addresses three challenges in making this approach work.<p>First, Mylar allows the server to perform keyword search over encrypted documents, even if the documents are encrypted with different keys. Second, Mylar allows users to share keys and data securely in the presence of an active adversary. Finally, Mylar ensures that client-side application code is authentic, even if the server is malicious.
It seems absolutely ridiculous that large piles of data are being stolen by small teams of hackers. If solutions like Mylar's prevent reading of the extracted data, that sounds promising. Sure, it's just another hurdle in an attack but it's something.<p>I wonder if we're only a few years away where technologies and practices like this become standard?
So someone builds a nice secure and useful framework/platform which is great. But why not put some effort to mention some more details or documentation about how to use it, sample, tutorials etc?
"First, Mylar allows the server to perform keyword search over encrypted documents, even if the documents are encrypted with different keys."<p>I thought some big tech corporation owned the patent on that.