0

Ok, I know that every obfuscated .Net application can be reverse engineered.

And I know that it is better if I go the open source way if possible. But unfortunately I cannot because there is no copyright law to protect me where I live.

So I've come up with a plan to make it harder. Since I'm very very novice regarding the security I hope that you will help me find any loopholes in this plan.

  1. The user downloads the application
  2. The user enters his username/password and starts working
  3. He need to export the results to a specific file format
  4. The application connects to the server, and checks the username/password
  5. The data required to create the file are sent to the server
  6. The server creates the file on the server and sends it back to the user

Now if someone cracks the program by bypassing the username/password check the file won't be sent from the server and he won't be able to get the file he wants, something similar software as a service.

Now I want to know if this is the correct way to go? What suggestions to make it better?

2
  • I don't understand the mention of open source. How could copyright law help you protect your application if you made it open source?
    – svick
    May 3 '15 at 18:24
  • I have not. I mean I cannot open the source to the public!
    – Vahid
    May 3 '15 at 18:29
2

If the whole purpose of your application is to let the user input some data and then create a file in a specific file format from that data and you want to prevent unauthorized users from doing that, then yes, moving the file creation to a server will prevent that.

Though there are still some things to keep in mind:

  1. You need to secure your server. If an attacker can breach your server and copy your code from there, no authentication scheme will help you.

  2. You somehow need to make sure that unauthorized users won't get their hands on a valid username/password combination.

    For example, imagine an authorized user publishes their username and password somewhere. How will you detect it and how will you deal with it?

  3. Your application could still help an attacker with reverse-engineering the file format itself (but not your code directly). For example, they could try input various data into your application and observe how does the output file change.

  4. Consider getting rid of the client application and instead make your application web-based.

3
  • Thank you so much for the insight svick. Is it that easy to attack the server and steal the code? I'm going to get hosting service not a VPS. Will it be prone to attacks? I cannot make it web-based completely because it is a CAD program and needs its own interface other than a browser.
    – Vahid
    May 3 '15 at 18:40
  • The file itself cannot be reverse engineered. Because it is not trivial. It is a CAD file and is different for each user based on their data.
    – Vahid
    May 3 '15 at 18:41
  • The 2 things I'm concerned about are the attacks on the server and the fact that a user may share their username/pass with others. Any idea how to prevent this?
    – Vahid
    May 3 '15 at 18:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.