C chrjak Active Member Licensed User Longtime User Feb 7, 2015 #1 In b4a apps you can read every password out of an apk... FTP, File encryption, etc Could you make it harder to hack a password erel? For example a #Password# Command? That the string between this command will be encrypted in the apk or something like that?
In b4a apps you can read every password out of an apk... FTP, File encryption, etc Could you make it harder to hack a password erel? For example a #Password# Command? That the string between this command will be encrypted in the apk or something like that?
DonManfred Expert Licensed User Longtime User Feb 7, 2015 #2 Why are you storing unencrypted passwords in your code? If you need safety; DO IT YOURSELF. Use encrypted passwords (and so on), compile your app obfuscated
Why are you storing unencrypted passwords in your code? If you need safety; DO IT YOURSELF. Use encrypted passwords (and so on), compile your app obfuscated
C chrjak Active Member Licensed User Longtime User Feb 7, 2015 #3 is it possibile to encrypt your password in the b4a code? If you code with java it is possible to hide your password... i know But even in obfuscated mode the password is in the main.java file visible... the only changing is that the variable name is changed (thats what obfusacted mode does...) Last edited: Feb 7, 2015
is it possibile to encrypt your password in the b4a code? If you code with java it is possible to hide your password... i know But even in obfuscated mode the password is in the main.java file visible... the only changing is that the variable name is changed (thats what obfusacted mode does...)
Cableguy Expert Licensed User Longtime User Feb 7, 2015 #4 You have the encryption lib, and you have code obfuscation. General "good coding rules" say to never hard code passwords... encrypt them and save to a file. When needed, read the file and decrypt! Even assets can be encrypted now!
You have the encryption lib, and you have code obfuscation. General "good coding rules" say to never hard code passwords... encrypt them and save to a file. When needed, read the file and decrypt! Even assets can be encrypted now!
C chrjak Active Member Licensed User Longtime User Feb 7, 2015 #5 but then the password for the password file has to be hard coded!?
wonder Expert Licensed User Longtime User Feb 7, 2015 #6 Can anyone post a "good practice" example? I want to secure my DB password. So far I have it hard-coded in Process_Globals with obfuscation. I'm sure there's a better way.
Can anyone post a "good practice" example? I want to secure my DB password. So far I have it hard-coded in Process_Globals with obfuscation. I'm sure there's a better way.
Cableguy Expert Licensed User Longtime User Feb 7, 2015 #7 Give it a nonsense variable name and encrypt it to a file
wonder Expert Licensed User Longtime User Feb 7, 2015 #8 Cableguy said: Give it a nonsense variable name and encrypt it to a file Click to expand... Cool, I think I know how to do it!
Cableguy said: Give it a nonsense variable name and encrypt it to a file Click to expand... Cool, I think I know how to do it!
C chrjak Active Member Licensed User Longtime User Feb 7, 2015 #9 hey cable, how do you decrypt the asset files when you don't use a hard code password?
Cableguy Expert Licensed User Longtime User Feb 7, 2015 #10 Search the forum, there are hundreds of examples... There is a tool to encript the assets folder and a tutorial on how to decrypt when needed. Just use "encrypt assets" in the search box, and guess what...!? Its the first result shown!!!!
Search the forum, there are hundreds of examples... There is a tool to encript the assets folder and a tutorial on how to decrypt when needed. Just use "encrypt assets" in the search box, and guess what...!? Its the first result shown!!!!
Erel B4X founder Staff member Licensed User Longtime User Feb 8, 2015 #11 You should use Release obfuscated and set the string as a process global string. It will be obfuscated.
You should use Release obfuscated and set the string as a process global string. It will be obfuscated.
C chrjak Active Member Licensed User Longtime User Feb 8, 2015 #12 Cableguy said: Search the forum, there are hundreds of examples... There is a tool to encript the assets folder and a tutorial on how to decrypt when needed. Just use "encrypt assets" in the search box, and guess what...!? Its the first result shown!!!! Click to expand... I know. I was there already. but that: Private Sub UnpackEncryptedAssets(StoreName AsString, Password AsString, Version As Int) .... end sub Is hard code....
Cableguy said: Search the forum, there are hundreds of examples... There is a tool to encript the assets folder and a tutorial on how to decrypt when needed. Just use "encrypt assets" in the search box, and guess what...!? Its the first result shown!!!! Click to expand... I know. I was there already. but that: Private Sub UnpackEncryptedAssets(StoreName AsString, Password AsString, Version As Int) .... end sub Is hard code....
C chrjak Active Member Licensed User Longtime User Feb 8, 2015 #13 Erel said: You should use Release obfuscated and set the string as a process global string. It will be obfuscated. Click to expand... Thanks. I tested already. In the .java there is "" when you use obfuscated... Is there absolutely no way to make it visible? That is great
Erel said: You should use Release obfuscated and set the string as a process global string. It will be obfuscated. Click to expand... Thanks. I tested already. In the .java there is "" when you use obfuscated... Is there absolutely no way to make it visible? That is great
Erel B4X founder Staff member Licensed User Longtime User Feb 8, 2015 #14 There is always a way to decompile strings. Obfuscation makes it more difficult.
