Through some research I have found that obfuscation won't block hackers from retrieving your .json file, but I'd like to have at least a level of obfuscation that deters some people. I ran into a npm package called bson that creates binaries for a json format. Can you call this obfuscation to a degree? I am also at a dilemma because my .json files serve a WebGL gaming engine via iframe.

Unity developers obfuscates most of their code via third-party obfuscation tools in the Unity Asset store. It is than rendered into WebGL. I was wondering if some similar tools that helps me achieve obfuscation of .json this through webGL frameworks like babylon.js and three.js

My main goal is just to obfuscate when a user inspects the incoming .json file in the network tab.

  • 1
    I think you answered your own question. Sure, the data might be "obfuscated", but is certainly still recoverable by a determined attacker. It's likely up to you to determine what level of obfuscation is sufficient. – multithr3at3d Aug 17 '19 at 14:14
  • Hi and welcome to RE.SE. Security by obscurity is no security. It's at most something to throw off laypeople. I'm not sure from the top of my head what other tools exist (Python with its json module comes to mind, though), but given there are literally browser extensions that allow to format JSON data, I don't see how your obfuscation would provide any kind of deterrence. After all the JSON still needs to be readable by some program, right? So another program could also simply parse the JSON data and be instructed to dump it pretty-printed. – 0xC0000022L Aug 17 '19 at 22:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.