Security Basics mailing list archives

Re: Re: HTML/Java protection


From: kikenico () gmail com
Date: 20 Sep 2005 15:19:52 -0000

As Eduardo says, if it's a client-side processed file (and java files usually are) you can't prevent users from 
download it, since it has to be done so in order to interpret it. So, knowing that fact, you could turn your 
application into a server based application, set up a couple of servers and let the users to execute that file over 
your net (Application Service Provider) for maybe some kind of paypal donation. But this is not a cheap alternative, 
not even afordable for a common user. 
So, let's say the final user is going to download the file anyways; at this point the only thing you can do is to make 
it difficult to "read" your code, so let's talk about turn your java aplication into a real executable file, obfuscate 
it or encrypt using a custom classloader or something similar; doing so, when people try to decompile they will get a 
nearly unreadable code which will need a lot of work to make clear (a lot more work and skills than try to make the 
thing by yourself). So, what is the best? That depends on how important is the data which you don't want to be seen, 
but the easiest, cheapest and quickest method is obfuscation (an exe file is not multiplatfrom, encryption is a lot of 
work -not to mention that you have to store the key somewhere-), which will turn your code in unreadable at first 
sight. Try googling how to obfuscate java, for example: http://www.javaworld.com/javaworld/javatips/jw-javatip22.html , 
or make up your own obfuscation method. Good luc
 k!


Current thread: