I have to make a website for a NGO (Non-Governmental Organization), and they have the minimal options from their provider, so they can't have SSL/TLS (barely only HTML/PHP/MySQL/JS)

The data that goes from and to the server aren't very sensitive, but I don't want their passwords, name and address to be sent clear on the web.

I thought about ciphering data inside the JavaScript that calls the API functions with RSA (I'm no expert, but this lib seems pretty efficient), but I red an article that strongly advise not to use JavaScript for crypto (I'm French and maybe I didn't get everything right, but I got the main point).

So what should I use to cipher the data over the network?
If JS isn't really a bad idea, what can I do to ensure maximum safety with the technology I can use on this server (once again, no HTTPS, sadly), apart from importing the lib on my server and not relying on importing it from a different sever?

No SSL, no security. Things in the real world are rarely simple, but here it is the case. This is easily seen as follows: whatever you do in Javascript, will be done in Javascript sent by the server. Any attacker who is in position to look at the data can also modify it at will (e.g. the easiest way to spy on WiFi is to run your own fake access point, and then you naturally get to modify all data as it comes and goes); thus, such an attacker can simply remove or alter whatever Javascript-based solution you may come up with, and deactivate it. Or just add a hook to also send the password in the clear as an extra parameter.

Now, even if you could get "safe Javascript" on the client browser, then you would run into all the problems that Javascript crypto entails, and that are detailed in the article you link to. But this is only a secondary consideration, compared with the fundamental flaw explained above: with no SSL, you cannot ensure that what runs on the client browser is your code.

Trying to handle password securely on a non-SSL Web site is akin to trying to perform brain surgery safely with only a tea spoon and a rusty crowbar. Just don't do it. If there is sensitive data that flows to the Web site (e.g. names and addresses), then you MUST apply reasonable protection mechanisms. If the data is not sensitive, then why would you need passwords ?
