Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am developing an open source software. This software generates content that is sent to a server for publishing. Anyone can get this software and generate content.

The API for publishing at the server is also public. (Can be changed if necessary).

Is there a way I can make sure the content was generated with this software and not any other tool?

My first guess would be to sign content generated with "my" software. I can't stop anyone else of signing the code the same way.

Thanks

share|improve this question
3  
This is provably impossible to do. –  tylerl Jun 19 '13 at 17:19

2 Answers 2

No there is no way to future proof the content output of an open source product against mimic software acting as an impostor. By definition, any open source project can be forked to do exactly the thing about which you are concerned.

You can (must) address this issue with trust rather than technology. Trust is precisely the opposite of an API. Trust relies on humans making risk decisions rather than code somehow watermarking output.

share|improve this answer
    
Out of curiosity: how would you do it with a closed source software? –  user27396 Jun 19 '13 at 14:17
    
@user27396 It will be harder (as the API has to be reverse engineered), but not impossible. –  Terry Chia Jun 19 '13 at 16:24
1  
To echo Terry, there are people who are very good at reversing software and APIs and there are some nice tools to support it. If your software or API does anything interesting or useful, someone will want to understand exactly how it works. –  u2702 Jun 19 '13 at 17:55
    
Not suggesting there is a difference here between open and closed in this context. That was not in the question thus not addressed. Trust is the only path to success in either case. –  zedman9991 Jun 20 '13 at 12:34

Everything that comes from a system that you don't control is suspect. There's no way to have 100% confidence that content comes from a certain program.

By the way, if you embed a key into your software and use that to sign content before upload, someone will pry out that key and put it into their own software.

share|improve this answer
    
true, but the idea wouldn't be having the key hardcoded but else by configuration. The key would be provided upon request. Of course, once given the key you can give it away. Controlling who gets a key is also difficult since the idea is to reach a large audience. –  user27396 Jun 20 '13 at 8:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.