16

Don't. You show a lack of understanding of the topic. I don't really trust them since I can't know what their code is doing to my passwords (like maybe it's storing them on a central server?... NO!) Read the source. For instance Keepass is Open Source. You can verify how it works, and if it transmits anything. I'm not aiming for Bank-level security, ...


10

Disclosure: I am the Chief Defender Against the Dark arts at 1Password. I am going to discourage you from trying at this point. As others have pointed out, your basic failure to understand key concepts (at this point in your learning) means that you aren't in a position to face some of the harder questions in the design of a password manager. I do not mean ...


8

What is the "best" way to encode a text so it can be stored somewhat securely in a text file and later be de-coded so the text can be read (preferably only by the owner) This is literally exactly what "encryption" is. The best way to do this is to use a secure cryptographic cipher (a function that takes as input a key and some plain-text data and emits an ...


4

a lot of them are written in assembly or C to keep the binary size as small as possible. It's not about the size, but about external dependency. Malware is usually written in Assembly or C to minimize external dependency. If a malware is written, let's say, in .Net Framework 4.6.2, and the victim runs Windows XP, it will not work. This is why authors ...


3

You are overcomplicating this. A counter of QR codes per day, daily salts, values that need to be synchronized... I would simply design the application having an ECC keypair. When A wants to give N points, it makes a 'coin' with the information (timestamp, sourceUser, points, expiry), signed with its private key. Then user B scans the coin and presents ...


2

You can add an external lib to the product, made in C/C++. Python can import those just fine. Add a couple vital functions on that library, and change the library a little for each client. An interesting way of doing this is to use internationalization to encrypt most of the strings, and use the external library to decrypt them. Use a custom key to each ...


2

Step 1: The auto incremented id implies you're worried someone would know the id one day. In that case they would know it on other days too. Step 2: If the salt isn't long enough, someone can find it by brute force if they know their own id, and then they'll be able to use the id they got in step 1 to create the md5 which is the userKey.


2

And the problem is how to manage the whitelist. And that problem makes your solution impossible. Let's see why. Debuggers and other developer tools They can access low-level functions like those used by keyloggers, but are used for legitimate reasons by developers. If you whitelist those, developers are in risk. If you not, they productivity will be ...


1

Securing mods is hard. You have some apparently conflicting requirements: High performance, both in terms of running fast and communicating efficiently with the base game (and/or other mods). This generally implies machine code, running with the executable, e.g. as a DLL. Preventing the code from accessing any dangerous functionality, like reading arbitrary ...


1

The rule of thumb is this: If you have any hardcoded password in any piece of client side code, then it should be considered discoverable. This goes for any application on any platform. It's not just print statements, but any code whatsoever. Even obfuscated code can be decompiled and analysed. We have various questions on here related to this problem. ...


1

Infosec consultant here. In theory the cybersecurity programs being offered at colleges will prepare you for a career in information security. In practice I've not found that to be true. My recommended knowledge to have under your belt before starting in infosec: Have a hardcore grounding in computer science. This means algorithms and data structures, OS ...


1

From MDN web docs: Subresource Integrity (SRI) is a security feature that enables browsers to verify that resources they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched resource must match. The idea is to generate a hash from your web app files ...


1

It might be easier to assign an identifier to your product, and tie those identifier details with customers that buy the product. Another issue though is that even if someone did leak your product, it can often be very difficult to do anything about it, let alone enforcing it. So if you want to protect your product it would be wise to look into using license ...


1

Given the clarification in the comment (should be in question, most important bit of information!), the answer is yes. Accidential modification is something that should in theory be quite unlikely as there is link-level CRCs in place as well as checksums in the TCP/IP stack. The theoretical chance of an accidentially modified packet passing the link layer ...


1

Your process is not OK. How can you make sure checksum is transferred correctly or hasn't been tampered with along the way? You need some sort of authentication before transferring file, a handshake! All this can be solved using SSL. You will not have to worry about anything.


1

Is this a good way to figure out who is leaking my software? It's viable - but you also need to build another application to track the changes applied to the code and link these to customers. But the elephant in the room is what you intend to do when you find an unlicensed copy of the software somewhere. You merely have a very strong indicator of which ...


1

I do not see a straightforward solution here, as ThoriumBR mentioned, you can add an external lib to the product, made in C/C++. Python can import those just fine. Add a couple vital functions on that library, and change the library a little for each client. The idea to use these external libraries for encryption I do like. A system similar to that ...


Only top voted, non community-wiki answers of a minimum length are eligible