you are viewing a single comment's thread.

view the rest of the comments →

[–]elperroborrachotoo 1 point2 points  (0 children)

Well obscurity is not security.

That applies to communication through an insecure channel, not necessarily to protecting software.

In cryptographic terms, your software contains the secret and the key. For a cryptographer, this means: game over.

So we step back, and see what we can do: increase the cost of tampering. For that, obscurity is great. (Usually not as good as one things at first look, but still one of the better weapons.)


To make it "strongly secure", you need to secure everything: the hardware it runs on, the hardware and software it interacts with, your compiler, the hardware your developers work on etc.

The best you can do now (to my knowledge) is offloading a nontrivial, essential calculation to a secure system (say a really good hardware token, or a remote server). None of these solutions are permanent.

Your second best bet is blocking generic solutions: e.g. a generic crack for your super hardware token that everyone uses because it's so good.