Questions tagged [security-by-obscurity]
A security anti-pattern in which secure information is "protected" by making it "hard to find" in the mistaken belief that it is then secure. It is the approximate equivalent of hiding the front door key under the mat.
35
questions
-1
votes
1
answer
47
views
php obscure email address with modifications
Sometimes my content has email addresses in it - but I want to obscure them using javascript.
I have made a javascript solution for the frontend which rebuilds them but only from a certain format.
...
0
votes
0
answers
171
views
Image Privacy: Base64 or Privacy Through Obscurity
I'm trying to find an answer to a dilemma and I'd like some suggestions.
Type of app: a web app using Ruby on Rails.
Issue: product owner wants to minimize access to images for privacy reasons.
...
0
votes
1
answer
198
views
Is there a way to obscure the activities with Proguard in Android?
I know that Proguard does not obscure the names of the activities that are declared in the manifest.xml. Is there anyway a way to obscure them?
0
votes
2
answers
224
views
Drawing parts of a Blob to html canvas without data urls in Javascript
I'm testing something out using a webapp where users can see a few pieces of an image but not all of it at once. The whole data is sent down to the client and decrypted client-side. That data is then ...
0
votes
4
answers
357
views
Rearranging characters in a 15-digit string with the ability to revert to the original string
I have numerous 15-digit numbers. I need to rearrange the digits in each string based on a set order to hide the composite identifiers. For example: convert 123456789123456 to 223134897616545
The ...
0
votes
1
answer
31
views
Non-accessible configuration design
Due to design constrains the project I am currently working on won't allow us to write certain set of configuration parameters in plain text file such as properties files (mainly due to security ...
0
votes
1
answer
59
views
Numerical Obscurification
Similar to this question in C#: User ID obfuscation
I'm looking for a solution in VBA to obscure a long value through an encoding method and also I would need to be able to decode the number produced ...
1
vote
1
answer
540
views
How Safe is an Obscure File Download Link?
Here's what I'm trying to do:
I want to distribute my Vcard (.vcf) file by hosting it on my personal website (this part is a rigid requirement). People will access it from a QR code on my business ...
2
votes
2
answers
262
views
Using @ in a C or C++ application [duplicate]
I came to this obscure thing ... I would like to know if there are any possibilities for the @ sign to appear in the source of a valid C/C++ application, beside of the following situations:
a const ...
1
vote
1
answer
1k
views
Obfuscation of URLs - rails
I'm working on a project that's left me stumped, hoping someone out there might have some interesting input. I see there are several gems available for obfuscation of urls, but they seem to stop at ...
0
votes
1
answer
479
views
What's the optimal method to obscure String(Java - Serialization)
What's the optimal method to obscure String
For learning purposes I've decided to dig in a bit more into Java Serialization, most of it is fine. However I've been coming across this weird issue when ...
0
votes
0
answers
63
views
Database security encoding
I want to ask you if there are (in practice) techniques for encoding a database in such a way, that table names are arbitrary and fields are encoded(not encrypted) in some way.
For example consider a ...
4
votes
5
answers
2k
views
Should i obscure database primary keys (id's) in application front end
I'm working on an application which allows a moderator to edit information of user.
So, at the moment, i have URL's like
http://xxx.xxx/user/1/edit
http://xxx.xxx/user/2/edit
I'm a bit worried here, ...
0
votes
2
answers
1k
views
Is there any JS library to obscure string manipulation?
I'd like to make the string manipulation as obscured as possible.
Now I wrote a small function made HEX string from the original string (the length of the result is twice as the length of the ...
-3
votes
1
answer
96
views
De"compressing" Javascript [duplicate]
This will without a doubt be a duplicate, but I have no idea what else to call it.
A friend of mine is trying to learn Javascript. He accidentally saved the "compressed" (all whitespace removed) ...
0
votes
1
answer
402
views
Entry Point Obscuring
I've been writing an EPO program and so far I've been able to find a call opcode and get the RVA from the following address in the binary, then parse the IAT to get names of functions that are ...
0
votes
2
answers
69
views
Privacy, Protection, Obscurity
I'm working on a project with a few interesting requests from the client. Wondering if anyone has any suggestions or would like to weigh in.
I'm creating a Web App for my client to distribute ...
3
votes
1
answer
345
views
Secure Connection to LDAP Server
I am using a hash to encrypt and decrypt my passwords which I am sending to a cass construct. Exampled below:
public static function HashPassword ($Password){
$salt = self::$Salt;
...
3
votes
2
answers
1k
views
How to obscure hard coded password in code?
I would like to obscure a password in my VB6 code, such that it cannot be revealed even via decompilation.
Is this possible?
1
vote
1
answer
405
views
OAuth Javascript: twitter, security through obscurity? Have a better approach?
Background
Lets say I want to use twitter's javascript api.
The twitter javascript api says
Be cautious when using JavaScript with OAuth. Don't expose your keys [1].
It sounds like using ...
0
votes
2
answers
777
views
What techniques are available to obscure shader assets?
I have a number of shaders in my games and apps, I currently use a simple program I made to take the shaders and generate a java class which puts the text into a StringBuilder, one char at a time, so ...
5
votes
3
answers
519
views
How to hide literals in code
What are the main existing approaches to hide the value of literals in code, so that they are not easily traced with just an hexdumper or a decompiler?
For example, instead of coding this:
...
3
votes
1
answer
846
views
How to monitor user action on .NET web browser control without obfuscation?
I have embedded web browser control in WinForms app. The user makes some actions on site that doesn't belong to me. At the end (eg. on last page) I need to send confirmation to my server (eg. via web ...
1
vote
2
answers
1k
views
How to obscure Wordpress?
I am running a site using Wordpress as CMS System.
Now I don't want anyone to know that this site is powered by Wordpress in the background.
Is there any easy way to completely obscure Wordpress?
...
32
votes
8
answers
3k
views
Isn't a password a form of security through obscurity?
I know that security through obscurity is frowned upon and considered not really secure, but isn't a password security through obscurity? It's only secure so long as no one finds it.
Is it just a ...
4
votes
2
answers
430
views
Obfuscation in .NET vs. Delphi
I have old Delphi application. This app takes session key from server, do some stuff with secret using this key like hashing etc. and post back cipher to the server. Server knows how to retrieve data ...
1
vote
4
answers
1k
views
Security by obscurity: what about URLs?
first of all, the question from a naive point of view:
I've got a WebApplication with a URL to a product like Products?id=123. Let's say I've got an administration page reachable from Products?id=123&...
3
votes
2
answers
5k
views
Obscure and encode a URL parameter
I want to encrypt a URL variable so that the user can't see the information when it is passed. I've found several scripts online but none of them work. Most seem to lean toward using base-64. Could ...
1
vote
8
answers
551
views
I want to use security through obscurity for the admin interface of a simple website. Can it be a problem?
For the sake of simplicity I want to use admin links like this for a site:
http://sitename.com/somegibberish.php?othergibberish=...
So the actual URL and the parameter would be some completely ...
2
votes
5
answers
1k
views
Is it possible to have an open source implementation of DRM software? [closed]
I am curious to know if anyone has figured out a way to create the server portion of DRM in an open source manner while allowing for DRM clients to be closed. I understand that if the client were open ...
1
vote
6
answers
3k
views
The best approach to scramble CSS definitions to a human-unreadable state throughout an ASP.NET application
I'm not sure if it will bring anything beyond saving on traffic through the removal of long-worded names, but I would definitely want to hide my system of namings, declarations and their organization.
...
78
votes
14
answers
40k
views
Why is security through obscurity a bad idea? [closed]
I recently came across a system where all of the DB connections were managed by routines obscured in various ways, including base 64 encoding, md5sums and various other techniques.
Why is security ...
1
vote
6
answers
2k
views
Masking an external URL
I need to be able to open up an external URL in my website with out revealing it to my users (both in the browser and in the source). I do not want them to be able to copy the URL and edit the query ...
19
votes
12
answers
16k
views
Is using a GUID security though obscurity?
If you use a GUID as a password for a publicly facing application as a means to gain access to a service, is this security through obscurity?
I think the obvious answer is yes, but the level of ...
62
votes
14
answers
46k
views
Encrypting/Hashing plain text passwords in database [closed]
I've inherited a web app that I've just discovered stores over 300,000 usernames/passwords in plain text in a SQL Server database. I realize that this is a Very Bad Thing™.
Knowing that I'll have to ...