Похожие чаты

Are you going to hardcode the password on your application?

27 ответов

22 просмотра

yes (configs one only)

Gian- Автор вопроса
Kazem
yes (configs one only)

Just use a configuration file

Gian- Автор вопроса
Kazem
why

because if someone reads the source code of your application they'll know the password to the sqlite db for *all* deployments of your application.

Gian
because if someone reads the source code of your a...

Not even, just some reverse engineering and keys to the castle.

Gian
because if someone reads the source code of your a...

but json is a plain text and would be opened by a notepad

Gian- Автор вопроса
Raptor Blue Bear
Encrypt the values

where the encryption key comes from?

Gian
so what?

easier than reversing source

Gian- Автор вопроса
Kazem
easier than reversing source

security through obscurity.

Gian
where the encryption key comes from?

well, that depends. I'm a fan of using Fernet and letting the person installing the app set and secure the Fernet key

Gian- Автор вопроса
Raptor Blue Bear
well, that depends. I'm a fan of using Fernet and ...

this just shifts the issue somewhere else. also, anyone accessing the deployed application can access stuff

Gian
this just shifts the issue somewhere else. also, a...

Well, it shifts the responsibly away from the software and towards securing the operating environment better.

Gian- Автор вопроса
Gian
the security is *always* on the OS

no that's actualy on the person using the OS :D thats why social engineering always works

Gian- Автор вопроса
Kazem
no that's actualy on the person using the OS :D th...

what I meant is that the security of any application installation is dependant on the OS being secured. reverse engineering is irrelevant on this context.

Gian
the security is *always* on the OS

It's still not a great idea to leave an unencrypted and/or unhashed username and password laying around in plain text

Gian- Автор вопроса
Raptor Blue Bear
It's still not a great idea to leave an unencrypte...

the username is ok. if your application/db supports connecting with hashed password, that's good practice to have. also, you can use plain file permissions to secure your file.

Gian
the username is ok. if your application/db support...

It's much harder if you need to unravel two or more pieces of information than just having to worry about one. Using multiple methods to hash and encrypt data in plain text files is just good security practice.

Raptor Blue Bear
It's much harder if you need to unravel two or mor...

yes that is but need to use unlockable hashed like aes so I need to decrypt them on app

Kazem
yes that is but need to use unlockable hashed like...

Read the given link, then come back here with more questions

Похожие вопросы

Обсуждают сегодня

Господа, а что сейчас вообще с рынком труда на делфи происходит? Какова ситуация?
Rꙮman Yankꙮvsky
29
А вообще, что может смущать в самой Julia - бы сказал, что нет единого стандартного подхода по многим моментам, поэтому многое выглядит как "хаки" и произвол. Короче говоря, с...
Viktor G.
2
@Benzenoid can you tell me the easiest, and safest way to bu.y HEX now?
Živa Žena
20
This is a question from my wife who make a fortune with memes 😂😂 About the Migration and Tokens: 1. How will the old tokens be migrated to the new $LGCYX network? What is th...
🍿 °anton°
2
30500 за редактор? )
Владимир
47
а через ESC-код ?
Alexey Kulakov
29
What is the Dex situation? Agora team started with the Pnetwork for their dex which helped them both with integration. It’s completed but as you can see from the Pnetwork ann...
Ben
1
Гайс, вопрос для разносторонее развитых: читаю стрим с юарта, нада выделять с него фреймы с определенной структурой, если ли чо готовое, или долбаться с ринг буффером? нада у...
Vitaly
9
Anyone knows where there are some instructions or discort about failed bridge transactions ?
Jochem
21
@lozuk how do I get my phex copies of my ehex from a atomic wallet, to move to my rabby?
Justfrontin 👀
11
Карта сайта