Hacker News Reader

Comment by kibwen | Hacker News Reader

An interesting link buried in the article:

http://www.macworld.com/article/1167677/hacker_exploits_ios_...

Does anyone know if Apple has addressed this yet?

In any case, it will be interesting to see if Mozilla can pull this off. When I download an app, isn't it just Javascript? What's to stop me from just diving into the app's source and putting in `function is_this_a_valid_app() { return "yep"; }` ?

View on HN

That is an old one.

The one concern for app developers on the FirefoxOS will be protecting their code. If its trivial to reverse an Android app and use that code it will be even easier to do it on FirefoxOS. So because of that most apps will be webapps and not native apps. The downside is you will need an always on network connection.

Validating and enforcing in-app purchases will not be a problem on Firefox OS if its a web app. Of course it can be trivially circumvented in native apps. More reason why I expect only webapps on that OS.

You also need an "always on" network to verify paid iOS or Android apps. They use web services for verification.

Apple has fixed "exploits" for iOS free stuff every single version they've released. If Mozilla becomes big the same thing will happen, and more of it. Apple stuff is compiled and at least sort of encrypted. Mozilla stuff is pretty much free game.

Counterpoint (with no particular value): encryption standards are publicly visible; does that make them less secure than proprietary and concealed encryption techniques?

I would have to say yes. It's a lot easier to break something that is has the code/methods available then play the hex guessing game.

But having an application which is 100% HTML/JS/CSS/Interest other scripting language here. Without any ability to opcache or byte code it and encrypt it. It's not going to take much to crack it.

If they somehow found a way to compress+encrypt the HTML/JS they may be able to make it at least a little bit more challenging. But that would take a lot of effort.

The likes of Java can be decompiled just as successfully as JavaScript.

Minification and obfuscation are quite common for web apps already. It's done for current phone apps, and it will be done for the new breed of web apps in just the same way.

minification is not obfuscation , obfuscation makes the code larger, not smaller. You can have it both ways. And you can easily un-minify javascript.

Rename all your variables to single letters. Tada, obfuscation + smaller code. They are not mutually exclusive.

Without any ability to opcache or byte code it and encrypt it. It's not going to take much to crack it.

You think bytecode is difficult to crack? :-)

One thing you can do is compile your JavaScript code to asm.js. That is low level enough to make things pretty difficult to reverse.

Until Hex-Rays Decompiler for asm.js comes out of course :-)

No. Proprietary techniques and algorithms are a bit harder to find out but are then usually just as fragile or secure as their open (source) counterparts. History has proven this over and over again.

Reply on news.ycombinator.com