Re: [Dev-C++] Simple encryption/obfuscation

[David M. <ci...@ya...>]

Does he have control of the server side?

--- Reid Thompson <rei...@at...> wrote:
> Use a key -- implement the key in the server side code.
> If "remember my password" is checked on connection to server,
> generate the file data to be stored on the client side on the
> server and
> fave the server return the file data to the client, which writes it
> to 
> the client host filesystem.  Then, decryption/validation occurs on
> the
> server side on attempted connections and the server binary is the
> only
> place that the key can be found.
> 
> David McKen wrote:
> > By definition of your problem anyone who know your algorithm is
> going
> > to be able to decrypt the file. Essentially a hacker has all the
> info
> > they need if they get their hands on the algorithm and the file
> that
> > has both the e-mail and the encrypted data.
> > 
> > Including a bit of randomness is not going to be easy to do as
> you
> > have to somehow rember that random value for you to decrypt it
> every
> > time.
> > 
> > Possibly hide the encrypted data in a file with some other data.
> And
> > maybe store the e-mail seperate from the encrypted data. Make it
> > harder for a hacker to get the data they want, this assumes that
> a
> > potential hacker already knows the algorithm.
> > 
> > Hope This Helps
> > David McKen
> > 
> > --- Ed Cottrell <em...@to...> wrote:
> >  > Hello all,
> >  >
> >  > I need help on an algorithm. I need to accept
> username/password
> >  > combinations
> >  > on the client side of a client-server app, store those on the
> >  > client side,
> >  > and "decrypt" them again without user input, using only the
> stored
> >  > strings.
> >  > Think the "remember my password" function in MS Outlook, IE,
> etc.
> >  >
> >  > Ideally, I would like to do this:
> >  > On first run:
> >  > 1) Accept email address
> >  > 2) Accept username & password pairs
> >  > 3) "Encrypt" username/password pairs with email address + some
> >  > machine-dependent data as a key
> >  > 4) Write these encrypted pairs and the email address to a text
> file
> >  >
> >  > On future runs:
> >  > 1) Read the encrypted pairs
> >  > 2) "Decrypt" them
> >  > 3) Do stuff.
> >  >
> >  > The best idea I have now is some block-and-bit chunking and
> >  > shifting - break
> >  > the string to encrypt into variable-length chunks, shuffle,
> >  > reassemble, bit
> >  > rotate, repeat. The "decrypt" would simply reverse the
> process. My
> >  > concern
> >  > is that anybody who knows the algorithm will be able to
> reverse it
> >  > quite
> >  > easily, given access to the text file.
> >  >
> >  > Any help is appreciated!
> >  >
> >  > -Ed

__________________________________
Do you Yahoo!?
Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes
http://hotjobs.sweepstakes.yahoo.com/signingbonus