2

Quite concise, but I'll elaborate with an example:

Lets say I have a simple app written in C# and i want to know how many people a day open the app. the easiest solution would be to simply have a function that that sent the current timestamp to say a php file on a remote server. that server then aggregates the timestamps in a database that can then be easily queried.

However, if the software is open source its a trivial matter for anyone to be able to essentially copy paste your work and send fake timestamps repeatedly, thus throwing off your numbers.

7
  • Hi Marcus. From your point of view, how does that is related to security? After all, its about statistics, right?
    – lepe
    Commented May 19, 2016 at 3:45
  • it is about statistics, but in particular im looking for the most secure way to lock down who can access certain files over the internet. in this case, the files im thinking of, happen to be for analytics, though i suppose the subject could be broadened. what i want to do, is essentially stop a person with malicious intent from being able to emulate my own code and create fake requests to a server, only allowing requests from a particular application, being my own. Though if you know where this question would be a better fit, please let me know, i'll move there. :) Commented May 19, 2016 at 3:52
  • 1
    Your question and your intention expressed in the comment above have little if anything in common. Could you decide on one?
    – techraf
    Commented May 19, 2016 at 4:11
  • @techraf im asking in particular about analytics, though this hits a much more broad subject matter, described in the comment. Essentially, I am not aware of a way to verify something a web request of any sort, analytics or not, is coming from my application, if the procedure for sending the request is made public. in my case, this applies to analytics, however you could apply the idea to any sensitive request. Commented May 19, 2016 at 4:19
  • Can you clarify the question - is this about analytics, or about identifying customers (as per lepe's answer) or trusting applications (as per Steffen's answer)?
    – Rory Alsop
    Commented May 19, 2016 at 13:48

2 Answers 2

2

Your main problem is identifying who are your "real" customers. As the code is open, its easy for anyone to emulate a client. So, how can you do it?

You can use asymmetric encryption. As the keys are not inside the code, there is no way they can "emulate" those keys. Each server will have its own keys. If encryption is too much for the client (and the information send is not that important), then you can simply use some shared key (like a password), which will be sent always along with the the request (something like a session cookie).

Either way, you still need to know who is who through some kind of authorization (e.g. login page). User/pass will be unique per server, so you can be sure that whoever download the keys or the "password", are authorized clients.

In the case your system has no login information (more general software) its more complicated (and that is what I believe is your real question)...

Well, am afraid there is no much you can do. Perhaps you can store some key downloaded from your server during installation (you can give each client an specific product-key). Not 100% safe, but it could help.

Web analytics are not 100% safe either. They can be faked (just google: 'how to fake web traffic'), but companies try their bests to identify real customers from fake ones with their own algorithms. The advantage they have, is that their code is not open, so you don't know what exactly they are taking into account.

I had once the same dilemma as you. In opensource, each server has its own configuration (which is private), and you can use that in order to keep away unwanted people on knowing everything about your service.

If I can think of something else, I will extend my answer, but that is all from now.

2
  • thank you! I really appreciate the trying to get to understand my question better, as I'm not the best at versing my situation. Its nice to know at the least that what I'm saying is theoretically impossible, i can put my mind to rest on the issue to some extent. The application in question is very general and would almost certainly pay a toll if a login were introduced. Commented May 19, 2016 at 4:38
  • Glad it helps. Just think that in order to achieve something like that, you need 2 black boxes: one in the server and one in the client. By "black box" I mean something that is not part of the "open source", in other words, hidden methods.
    – lepe
    Commented May 19, 2016 at 4:42
1

What you want in effect to know that the contents of a request is trusted. For this you would need to trust the remote application and to do this you would somehow verify that the application is exactly your application. This is called remote attestation. But, unfortunately this is impossible unless you lock down everything from start. For this you would need to be able to verify the boot process, the start of the system, the start of the application etc. Everything would need to be signed and you would need to interact with the system to check the signatures. Thus stays stays mostly theory except for some special use cases (i.e. game consoles are often heavily locked down).

In real life you just need to be aware that these requests can be faked and use common methods of statistics to sanitize the data. That's actually a problem most kind of survey has, i.e. people will lie in real life surveys too.

2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .