I just discovered this open source obfuscator for mobile apps, that is funded by the European Union.

This has me wondering about the motives, since:

  1. the EU seems to be trying to move towards open source projects for their public domain, so no reason to obfuscate
  2. obfuscation methods should, by definition, be secret
  • whaleross@lemmy.world
    link
    fedilink
    English
    arrow-up
    11
    ·
    12 hours ago

    Anybody using obfuscation for securing algorithms is fooling themselves. It can be useful in fringe scenarios when you know and accept the limitations but for general use it is not. There is no obfuscation clever enough that can not be broken down and figured out.

    Example - delaying cracking of copy protection for the first few weeks of a game release. It will be cracked eventually though, regardless the obfuscation and protection. Nobody expects it to be secure - but complicated enough to buy some time.

    Other example - obfuscating assets loader for your game app to make it slightly harder to steal the graphics for scams and knock offs. It will not stop anybody dedicated to it but it can make the lazy skip it and go for the next game instead. Nobody expects it to be secure, but it might work as a deterrent because the next bicycle has a simpler lock to cut.

    Counter example - thinking you’re clever by obfuscating your homebrew cryptographic algorithm. Just don’t. Use a FOSS crypto library, learn how to secure keys and be done with it. It’s not secure or safe in any possible way ever and it is a really bad idea all over.

  • Joe@discuss.tchncs.de
    link
    fedilink
    English
    arrow-up
    16
    ·
    14 hours ago

    Not everything will be open source. For whatever reason, they decided to make this obfuscator open source. It might also just be an interesting side project that someone got permission to release.

    Obfuscation can make it harder to reverse engineer code, even if the method is known. It might also be designed to be pluggable, allowing custom obfuscation. I haven’t checked.

    We also know that obfuscation isn’t real security … but it’s sometimes it is also good enough for a particular use case…