Secondary Data Encryption Via Browser Extension

A method for protecting sensitive data even when Transport Layer Security (TLS) communication sessions are compromised, the method comprising:

• sending, by a computing device, via a web browser plugin of a web browser application executing on the computing device, and to one or more remote servers, a request for a server secret that comprises:
• a device fingerprint of the computing device, and
• an identification of the web browser plugin;
• receiving, by the computing device, from the one or more remote servers, and in response to the request for the server secret:
• the server secret, and
• a public certificate associated with the remote server;
• establishing, via the web browser application, a TLS session with the one or more remote servers;
• generating, by the computing device, a session key based on:
• the server secret,
• the public certificate,
• the device fingerprint of the computing device,
• the identification of the web browser plugin,
• a unique identifier of a user of the computing device, and
• a nonce string;
• receiving, by the computing device, from the remote server, and via the TLS session, data comprising unencrypted data and encrypted data;
• and
• decrypting, by the computing device, the encrypted data based on the session key.

One or more non-transitory computer-readable media storing instructions configured to protect sensitive data even when Transport Layer Security (TLS) communication sessions are compromised, wherein the instructions, when executed by one or more processors of a computing device, cause the computing device to:

• send, via a web browser plugin of a web browser application executing on the computing device and to one or more remote servers, a request for a server secret that comprises:
• a device fingerprint of the computing device, and
• an identification of the web browser plugin;
• receive, from the one or more remote servers and in response to the request for the server secret:
• the server secret, and
• a public certificate associated with the remote server;
• establish, via the web browser application, a TLS session with the one or more remote servers;
• generate a session key based on:
• the server secret,
• the public certificate,
• the device fingerprint of the computing device,
• the identification of the web browser plugin,
• a unique identifier of a user of the computing device, and
• a nonce string;
• receive, from the remote server and via the TLS session, data comprising unencrypted data and encrypted data;
• and
• decrypt the encrypted data based on the session key.