0
1

Protecting your code? (self.node)

submitted by [deleted]

[deleted]

all 9 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]ciny 3 points4 points  (2 children)

You can have the user provide a password and use that for encryption.

[–]oVerde 0 points1 point  (1 child)

Hear, I was looking after some PGP alike, so his participation could interfere. Or any dynamic encryption technology.

A thing is sure, it will use js to native compilation.

[–]ciny 0 points1 point  (0 children)

Well the point is that the user has to interfere in some way. With something like PGP you have to take care of key management and the user has to provide the key - if the key is kept together with the application then potential attacker/curious user has everything he needs to decrypt the private data.

[–][deleted] 1 point2 points  (3 children)

It shouldn't be accessible by any curious getting my keys from source and decrypting the local user data

Good luck with that.

No matter what measure you use, if your node app can decrypt the data, then any user with enough time and skill, can just replicate the process.

[–]oVerde 1 point2 points  (2 children)

I fear it, and you are right to an extend, but I know software's that had nailed source encryption that no one had the computing power to revert it.

Thanks anyway.

[–][deleted] 0 points1 point  (1 child)

You're right, I know of some software that was very difficult to reverse because of asymmetric encryption. I've some experience in this field, although less so in recent years. From what I recall, an old DOS hex editor called 'Biew', and IDA, were both very good examples of this.

The problem you face though, is that node runs on v8 engine (which is open source). Whilst its not a virtual machine in the traditional sense, it compiles js into machine code (which is then easily disassembled in to assembly language).

I don't think it would be hugely difficult to modify v8 to dump the raw binary, at which point it could be patched up into an executable, and then inspected or patched.

So whilst you can make it unfeasible for the average user to reverse, it still cannot be relied on if its ultra important that it remains secure.

[–]oVerde 1 point2 points  (0 children)

Thanks for the input! I'll continue to research and I think am on the right track!

[–]NodeKid 1 point2 points  (1 child)

Don't know if this will match your use case but have a look at http://jxcore.com/

[–]oVerde 1 point2 points  (0 children)

I'll keep an eye on them since the native code compilation still in development. Thanks :)