0

I'm doing a hobby project Windows 8 app in WinJS. As I'm calling an external api, which requires an api key and oauth authentication, I've got a number of keys that I need to keep "secret".

I've seen places around the web with detailed descriptions on how to get access to and also modify the source code for WinJs (and C#) apps on your computer. But I think those were in the beta/preview time frame?

My Google skills don't seem to be able to tell me if this has been fixed since, does anyone know?

If it wasn't fixed, how do people handle these situations?

Any tips and suggestions welcome :)

Ola Karlsson
  • 9,011
  • 7
  • 27
  • 37

2 Answers2

1

You have a couple options here.

  1. Integrate Azure Mobile Services and have it do the oAuth if possible. Your keys remain secret in the cloud.
  2. Store the main key encrypted in your WinJs application. The secret then is also encrypted and stored locally. I use https://github.com/cauld/winjs-oauth-for-twitter and have a slight revision that when I get the key back I store it in the credential manager.

Any local application compiled from any computer language can be tampered with, all you need is a debugger. If you encrypt everything I in theory can just load up a debugger, attach to the http stack library and watch the data go out (excluding even easier techniques like Fiddler to watch this data) and extract whatever I want - fairly easily. So the question is what are you trying to prevent?

Adam Tuliper
  • 29,982
  • 4
  • 53
  • 71
  • Re:1 I was looking at signing up for trial Azure account but unfortunately the signup isn't working :( Re:2 When you say - Store the main key encrypted, you'd have to store the key to decrypt as well, so then there's no point in encrypting it, or? – Ola Karlsson Aug 26 '13 at 07:19
  • Encrypt it using local stored mechanisms such as the password vault. Its not completely immune to client tampering, but generally a suitable level of protection. Such is the issue with any key required on the client side - you can't completely prevent access to it. This is typical in oAuth apps that operate from the client. What happened with Azure? can you email me adamt @ ms with a screenshot/description? – Adam Tuliper Aug 26 '13 at 16:46
0

If your app could be facilitated to launch a man-in-the-middle attack, you should not keep confidential data in plain form for a long time, in memory or on disk. Also, storing encrypted data locally, alongside with the algorithm and the algorithm key/hash is a recipe for security incidents.

There is no silver bullet to protect your code or data from probing by the end user (or someone who has physical access to the end user's machine), see the amount of game save editors and game trainers out there. Don't put your business logic or important data (e.g. in-app purchases) in plain text or similar, at least add some obfuscation

Sheng Jiang 蒋晟
  • 15,125
  • 2
  • 28
  • 46