Decrypt AES User ID

[Simon Liddicott]

I have encrypted my user IDs in a way that can be decrypted by CryptoJS or Gibebrish AES with a password.

I'd like to be able to have Pii store my password and decrypt the user ID on the fly using either of those libraries.

https://code.google.com/p/crypto-js/ https://github.com/mdp/gibberish-aes

I use a slightly altered version of this to encrypt: https://github.com/legierski/AES

Slightly altered because I need it to always encrypt the same user ID the same way. In other use cases the encrypted values could be stored in DB against the user ID, and still decrypted on the fly without need for CSV etc.

[David Simpson]

Hi @silid, this looks most interesting. Gibberish AES appears to have a little more life in it than crypto-js (which I just exported to GitHub). Are there any security hits here, but I'm no expert. What so you suggest?

Also, how would you recommend storing the password in PII Viewer?

[Roland]

Hi,

I sent you an email but just found this after. I would like to implement what Simon has talked about. Can I get access to the source code?

[E.J. Daly]

I don't think there are any security issues here. The Google Analytics terms of service basically say that Google should not be able to associate data with a real person.

So, any kind of cipher would be fine. (Google are not going to try and break the cipher - that would probably breach their obligations to you)

So you can store the password in PII viewer however you want (plain text is fine). The password is likely going to be in your Javascript anyway (to encrypt the original userid) so you can't consider it to be protected data.

[Roland]

David can we get access to the repo? I'd like to attempt to add this functionality.