0

I was told by a friend earlier that

Encrypting something that needs to be reversed is a bad idea as it gives the illusion of security

Is this true? The way I see it, it can't really hurt to encrypt data.

5
  • 1
    What are you supposed to build that will be reversed? Jan 20, 2014 at 20:21
  • @LucasKauffman Private emails
    – Jon
    Jan 20, 2014 at 20:41
  • Why are you supposed to reverse engineer emails? Jan 20, 2014 at 20:47
  • I'm trying to store backups of emails I send. They'll be manually copy/pasted but they'll still be stored.
    – Jon
    Jan 20, 2014 at 20:48
  • and what's bad about encrypting them? Jan 20, 2014 at 20:49

2 Answers 2

3

You should only encrypt things that need to be reversed. If they do not need to be reversed (such as stored passwords), they should be one-way hashed with a secure hashing algorithm.

By definition, something that is encrypted must be able to be decrypted. Therefore, encrypted information is only as secure as the key used to encrypt it.

Key security is the most important aspect of encryption. A strong algorithm with a compromised key is no more secure than plain text.

For encrypting email correspondence, some implementation of PGP (e.g.OpenPGP) is the industry standard: http://en.wikipedia.org/wiki/Pretty_Good_Privacy#OpenPGP

EDIT: For encrypting files stored locally (such as an email archive), I recommend TrueCrypt: http://www.truecrypt.org/

Important! Keep in mind that if you forget or lose your encryption key, by design, the encrypted data is completely worthless and unrecoverable. Do not encrypt vital backups unless you are absolutely sure the key will not be lost.

2

It depends on what the goal is. A lot of people embed encryption to obfuscate data. Other tools such as Armadillo even go a lot further when it comes to obfuscation of code. Note that your friend is right that it will not give you any security. This is true, but it can slow people down trying to exploit or reverse your code.

I'm not sure what you mean with "something that needs to be reversed". I'm assuming you are talking about someone performing a security assessment on your application. It's true that this makes it more difficult in some cases. The advice I would give to clients who use such obfuscation is... give me access to the source code. In the end you are slowing someone down trying to assess the security of your app.

Now remember this person will be there as long as you are paying, if it's difficult he might not be able to cover your application properly because you are making him (the attacker) more difficult. This is good in a real life situation, but bad when you are trying to discover security issues.

So my advice, obfuscation is good, but give the source code to the person trying to assess your application. Otherwise you'll pay a lot of money with a high chance of the assessor not finding every problem in your application.

1
  • It's not code it's private meails.
    – Jon
    Jan 20, 2014 at 20:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .