Right now im storing passwords in plain text in the registry, i'd prefer not to use plugins, but does NSIS have any built in methods to actually encrypting plain text into the registry?
Thanks
Most string things can be done with the basic building-blocks; StrCpy, StrCmp andStrLen. For encryption/decryption you might need Asc and IntFmt $foo "%c" $bar as well.
You probably have to code the implementation yourself by inventing a new algorithm (Never invent crypto unless you know what you are doing) or using some existing scheme ported to NSIS. To me this seems like too much work just to avoid using a plugin.
A much better option IMHO would be to call the protected storage API with the system plugin...
Related
My company recently purchased the Full-Calendar Scheduler addon. Is there a proper way to hide the license key in code? What are good practices for this?
You're right, there's no way to completely hide the schedulerLicenseKey from someone malicious wanting to steal it, however, a thief could much more easily use the universal GPL license key if they wanted a warning-free version of Scheduler, so it's a moot point.
In essence, the actual characters of the license key are not that secret. The license key is mainly used to know when to prompt the developer that they have upgraded past their allowed version upgrade window. Beyond this, it is essentially an honor system. This is why not much attempt is made to encrypt/validate the key.
Use this code.
it works under Scheduler GPL license without charges
$('#calendar').fullCalendar({
schedulerLicenseKey: 'GPL-My-Project-Is-Open-Source'
});
Old question, but since I just came across the same issue, I thought I'd share my 2c. IMHO the best thing to do is never expose the key directly in the code. Instead, store it in some back-end configuration file or even a database field, and read it and assign it dynamically in the front-end. Granted, in the end someone willing enough can still reverse engineer the front-end code and read it (assuming they can log in to the application), but the key will never be that easy to read, as in committed with the rest of the code in your repo.
In short, best practice is to never store license keys in the code.
use 'valid' key, then your problem will be disappeared. I have some case too, then using that valid key, my problem solved.
I want to encrypt a code I wrote.
After a quick search, I have found recommendation on GPG.
Is encrypting code with GPG common and standard? I have read that it is supposed to be for e-mails.
If not GPG, what should I use?
You can use GPG for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk.
But the common way to secure your code is code obfuscation and not encryption.
Obfuscation creates ambiguous code, which makes reverse engineering difficult.
You can use spacial obfuscator for your programming language which is a programming tool that is used to transform readable code into ambiguous code without affecting code functionality.
I need a simple,small and efficient program for the following thing to do.
A small interface to choose a file from my PC.
Press encrypt/De-crypt button to do select whichever you need.
If encrypt is pressed, generate a random key and encrypt with some algorithm based on that key.
If decrypt is pressed decrypt the file using some algorithm.
I am planning to do it in visual C++. Can anyone please suggest a small program in VC++ to do this? or please tell me the library name where I can get all the functions to do the above.
If you think that there is some better language or framework available to do instead of VC++, please suggest. Thanks. I would very much grateful to you for this help.
Visually C++ can call clr code when compiled with these options. Once you have done that, you can use this api or the far more secure version that Microsoft published here. I'd use the second because then you get authenticated encryption for free. Otherwise you need to hmac the data and check it on the other end, which is a pain. In either case, make sure you use a random IV each time ( by default when you instantiate aes in .net , it creates a random IV so just use that). Prepend it to the message and retrieve it when you decrypt
I've a dataconfiguration.config encrypted file for an application on ASP.NET Framework 3.5
I need to change my connection string, how can i decrypted and read this file?
Security it's not an issue, I'm on a development enviroment.
Any tip will be preciated.
Thanks.
A common way to encrypt ASP.NET configuration sections (such as ConnectionStrings) is to use Protected Configuration. However if your file does not read as XML, this method was not used or was not the only level of encryption used. It sounds like maybe there was a third party tool involved.
If I were you, I would probably create a new config file, and find everywhere in the project the old config file was referenced to point things at the new file.
If that is not possible, maybe you'd have better luck posting a question in a general cryptography category or doing some searches on the subject. I know some encryption can be identified by look at the encrypted data. Some encryption schemes are designed specifically to hide that though. Good luck.
As SWFs are notoriously easy to decompile, If I am distribution SWF with secure keys inside or some valuable peace of code, how should I secure it?
EDIT:
I think it is very easy to decompile SWF because it is byte coded to SWF and then jitted to run. This same happens with Java compilation and execution. Does this mean even java codes are not secure enough?
Why, then, Java is far more trusted and reliable and SWF is not considered secure anywhere?
The short answer is DON'T do that. Even with code obfuscation, or storing data in a byte array, there is NO WAY to prevent someone who is determined (and able) from getting anything and everything from your source.
What type of secure key are you trying to put into your swf? What will it be used for?
Key theft is probably out. If someone is dedicated to it, they will find a way, despite obfuscation, to get at the key.
Code protection & IP is another matter. Here obfuscation and "encryption" (i.e. whatever is done to prevent decompilers from functioning properly) are valid methods. If your code is sufficiently obfuscated it would be very hard for competitors to steal it or to learn too much about your code's internals. It's just not feasible. Heck, trying to learn someone else's code is hard enough as it is, and so trying to decipher code that looks like loc_12312++; if (loc_23423) loc_4345(); is just not worth anybody's time.
I strongly recommend that if you care about the IP in your application's design and internal workings, you use a tool like SecureSWF to obfuscate the code as much as you can. Unlike with license keys, here the protection isn't as weak as its weakest link - the more you obfuscate the harder you make it to steal your IP.
Edit
My experience with Flex obfuscation tools is that you have to tweak the obfuscation quite a lot to get what you need. Simply telling the obfuscation software to rename all variables, classes, etc. is bound to break your application, unless it's really really simple. So you have to choose which packages and classes to obfuscate and tweak various other parameters in order to get a working application.
Once it's obfuscated though, it's pretty hard to decipher, in my opinion. Here's a sample, just to get a perspective:
I'd rethink what you're putting in the SWF. But that said, if you see no other options, NitroLM has a SWF encrypter which allows you to encrypt the SWF. Sharify is an alternative service.
In theory you could write your own mechanism for encrypting a SWF and your own "EncryptedSWFLoader." Of course, I suspect that any key in the SWF will most likely be something you need to send back to a server; and having someone sniff the packets--with a tool such as ServiceCapture or Charles--is more likely to be a source of "key leakage" than decrypting the SWF.
You won't get real security, but to make decompilation a little harder, use a code obfuscation tool, like doSWF, and/or store important data as byte array.
Edit: Ignore this answer: didnt spot the 'distributing' part **
If run from a webserver you can store your secure key in a text file, and read this text file into the swf from an assets folder (using urlLoader). People wont be able to get to the assets if you dont set public permissions, and the decompiled swf wont have that value (will just have a variable name).
How is it being distributed?