New answers tagged

2

Sooner or later an attacker will get access to the binary code of your application including your embedded password and thus will know the password. It is not serious to think that, if you scramble it, an attacker will not get the password. What are you trying to do is security by obscurity. Remember Kerckhoffs's principle 2. It should not require ...


1

Text? You are storing the key as binary, not as the text hexadecimal representation of the binary bits, right? There's security, and then there's making things slightly less convenient for an attacker. It sounds like you are assuming that they have a copy of the program and are reverse-engineering it. Whatever you do, what is to stop them from simply ...


7

Basically, you can't. What you look for is DRM by any other name, and history has shown time and time again that DRM isn't effective. Any skilled attacker in possession of the binary is therefore also in possession of the key, regardless of how well you hide it. Even if you were to store the key on your server and load it dynamically from the internet, the ...


1

There is a potential man in the middle attack by the server (B) in your model. Server can give mobile (A) its own public key as if it is coming from a client and it can give its own symmetric key (sk) to the clients as if it is coming from you. You need to implement out of band end-to-end authentication for the clients in other to authenticate A where server ...


Top 50 recent answers are included