I was curious about their "encryption" since they seem to emphasize it a lot.

https://www.stackfield.com/security

This page indicates they're using RSA-2048 and AES-256. Wow, that's so vague. So I signed up.

It's using Javascript Cryptography, which is never a good sign: https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...

Their RSA implementation is vulnerable to a padding oracle attack (Bleichenbacher's 1998 attack):

https://www.stackfield.com/Scripts/Plugins/rsa.2016012205415...

https://www.stackfield.com/Scripts/Plugins/rsa2.201601220541...

They're using AES-CTR, but they're not authenticating the ciphertext.

https://www.stackfield.com/Scripts/sf.wssecurity.20160122054...

(JSBeautifier comes to the rescue:)

    function DecryptOrganisationByMaster(e, a) {
        if (e === undefined || e.MyOrgRoleId === 3) {
            return false
        }
        var b = e.EncryptionCode,
            c = e.EncryptedCode;
        if (b === undefined || c === undefined || b === "" || c === "") {
            return false
        }
        if (OrganisationPasswords[e.OrgId] !== undefined) {
            return true
        }
        var d = Aes.Ctr.decrypt(c, a, 256);
        if (d === b) {
            OrganisationPasswords[e.OrgId] = a;
            return true
        }
        return false
    }

This really should have been reviewed by a cryptographer before being branded so heavily as an "encryption" solution.

EDIT: Also, their Aes.Ctr.encrypt() function doesn't accept a nonce:

https://www.stackfield.com/Scripts/Plugins/jquery.aes.201601...

See https://gist.github.com/paragonie-scott/53428f0947337d66a786