I am doing some Java work for a company that has some code that they want protected in an application that they are giving to their customers.
For example what if you have information such as FTP or DB login information in the client side application source code? The login would be visible to anyone who viewed the code, so access to your server is right out there in the open, which means your code on the server would also be vulnerable. Should the login information be protected by sending information using HTTPConnection/HTTPClient to the server to be processed while using Encryption in transit and sending login credentials to verify request is from a legitimate source.
However wouldn't that also prove to be risky in case the server is hacked/breached, and the Java source would be wide open? (Apparently Execelsior can do server protection with Tomcat applications so there is also that).
I was also looking into various Java-to-Exe programs such as Excelsior Jet, but I also ran into programs that simulate Exe's and apparently have protection such as JWrapper.
I had read in this question https://stackoverflow.com/questions/2244321/does-compilng-java-code-to-exe-e-g-using-launch4java-ensure-code-cannot-be-re
That the emulated exe's are not protected, and still contain Jar files, so I'm assuming the best bet are programs similar to Execelsior Jet, and a program such as JWrapper would not be good then?
Would it take more time for someone to decompile Native code than to try and hack a server (if they even knew what to look for, or that we are even trying to hide anything). My best bet would be doing server + Excelsior, but the price also goes up if I want to get their Enterprise version instead of Professional.
I am curious what approach people would recommend for safe protection methods. Thank you.
EDIT: This question is not a duplicate, because the other question asks about protecting Web Application code from "Web Hosts."
I am asking what the best method of protecting my source code would be. Whether Desktop, or server based. The other question could make sense if I was looking at a server solution, but doesn't provide a solution to my need.
EDIT2: It seems the consensus is that "if someone wants to break, they will..." but isn't there a point to protecting it to stop anyone from just looking at the code? There are coders who aren't knowledgeable in reverse-engineering, but still can understand code if it's readable.