yes (configs one only)
That's a terrible idea
Just use a configuration file
because if someone reads the source code of your application they'll know the password to the sqlite db for *all* deployments of your application.
Not even, just some reverse engineering and keys to the castle.
but json is a plain text and would be opened by a notepad
Encrypt the values
where the encryption key comes from?
easier than reversing source
security through obscurity.
well, that depends. I'm a fan of using Fernet and letting the person installing the app set and secure the Fernet key
this just shifts the issue somewhere else. also, anyone accessing the deployed application can access stuff
Well, it shifts the responsibly away from the software and towards securing the operating environment better.
the security is *always* on the OS
no that's actualy on the person using the OS :D thats why social engineering always works
what I meant is that the security of any application installation is dependant on the OS being secured. reverse engineering is irrelevant on this context.
It's still not a great idea to leave an unencrypted and/or unhashed username and password laying around in plain text
the username is ok. if your application/db supports connecting with hashed password, that's good practice to have. also, you can use plain file permissions to secure your file.
It's much harder if you need to unravel two or more pieces of information than just having to worry about one. Using multiple methods to hash and encrypt data in plain text files is just good security practice.
yes that is but need to use unlockable hashed like aes so I need to decrypt them on app
Read the given link, then come back here with more questions
Обсуждают сегодня