Hacker News Reader

Comment by chrismorgan | Hacker News Reader

Counterpoint (with no particular value): encryption standards are publicly visible; does that make them less secure than proprietary and concealed encryption techniques?

View on HN

No. Proprietary techniques and algorithms are a bit harder to find out but are then usually just as fragile or secure as their open (source) counterparts. History has proven this over and over again.

I would have to say yes. It's a lot easier to break something that is has the code/methods available then play the hex guessing game.

But having an application which is 100% HTML/JS/CSS/Interest other scripting language here. Without any ability to opcache or byte code it and encrypt it. It's not going to take much to crack it.

If they somehow found a way to compress+encrypt the HTML/JS they may be able to make it at least a little bit more challenging. But that would take a lot of effort.

The likes of Java can be decompiled just as successfully as JavaScript.

Minification and obfuscation are quite common for web apps already. It's done for current phone apps, and it will be done for the new breed of web apps in just the same way.

minification is not obfuscation , obfuscation makes the code larger, not smaller. You can have it both ways. And you can easily un-minify javascript.

Rename all your variables to single letters. Tada, obfuscation + smaller code. They are not mutually exclusive.

Without any ability to opcache or byte code it and encrypt it. It's not going to take much to crack it.

You think bytecode is difficult to crack? :-)

One thing you can do is compile your JavaScript code to asm.js. That is low level enough to make things pretty difficult to reverse.

Until Hex-Rays Decompiler for asm.js comes out of course :-)

Reply on news.ycombinator.com