Hash functions.

Hi all,

I read some information about hash functions in Windev to protect files. Is there more info available how to use these functions.
I have a file protected by HPass, but the password for this file is in the windev code, so not so secure.

Any leads are appreciated.

Best regards,

Aad

This subject can be very complex, just two simples questions/tips about what and how can it be done:

1) If want you need is to prevent anyone outside the control of your app to read the content of your database the hash functions aren't the best solution because the result fo the hash functions can't be reverted.
2) If you want to be sure that the content of the database can only be changed by your app the hash functions can help a lot.

For option 1 you can use HPASS, the password must be encryted or scambled in the code and only decrypted when needed. Other option is to encrypt all the sensitve data before writng it in the DB, you can use triggers for that.

For option 2 you can store one hash of the content of every record, salted with something only you know, and when you read the record check if the hash is correct, if someone changes the data from outside of your app the hash will be incorrect.

Regards

Paulo Oliveira



Edited 1 time(s). Last edit at 12/22/2021 06:22PM by pao.

Hi Paulo,

Thanks for your reaction.

What exactly do you mean by:

For option 1 you can use HPASS, the password must be encryted or scambled in the code and only decrypted when needed. ?

don't use anything like:
HPass("*", "your_password")
or
your_var is string="your_password"
HPass("*", your_var)

You can use something like this but, use a more complex solution this is only one sample:
my_array is dynamic array of int
ArrayAdd(my_array,121)
ArrayAdd(my_array,111)
ArrayAdd(my_array,117)
ArrayAdd(my_array,114)
ArrayAdd(my_array,95)
ArrayAdd(my_array,112)
ArrayAdd(my_array,97)
ArrayAdd(my_array,115)
ArrayAdd(my_array,115)
ArrayAdd(my_array,119)
ArrayAdd(my_array,111)
ArrayAdd(my_array,114)
ArrayAdd(my_array,100)
HPass("*",Charact(my_array[1])+Charact(my_array[2])+Charact(my_array[3])+Charact(my_array[4]).....)

Regards

Paulo Oliveira

Pao,

The problem with your approach, which has some merit of course, is that a hacker need only search for the function "HPass" and then easily understand the reversal process. Perhaps a better way, if more security is needed, is to:

1) Encrypt the database with the hash of the password
2) Then ask the user for the password on login
3) Hash the given password and see if it matches the hash of the actual password
4) if it is, then the database can be unlocked
5) if it is not, then the database will remain inaccessible

My sample was only to show that you shouldn't keep the password in plain text in the code.
A far more complex solution must be coded as i told before, you should consider things like changing the password and so on.

Regards

Paulo Oliveira



Edited 1 time(s). Last edit at 12/23/2021 10:49AM by pao.

Paulo,

Agree with you.

I do have a related question for the forum; does the obfuscation and encrypt-strings settings when creating the Android/iOS app packages provide any real security or are they easily reversible?

Thanks



Edited 2 time(s). Last edit at 12/23/2021 10:54AM by JP.

I was wondering if it's possible to put the hPass in a component or is such not possible, because values are not transferable to the main program.



Edited 1 time(s). Last edit at 12/23/2021 01:44PM by AadG.

AadG

The truth of the matter is this: once the database and app are on the computer of the hacker then it is only a matter of time before a competent hacker will compromise your database. This is 100% for sure. The reason is that the code is reversible and the password will either be discovered or intercepted.

So there are 3 questions you need to consider:

1) What are you trying to protect? How important is the data?

For example, some data is not important. Some is very important but might only be so for a limited time i.e. the value of the data expires in some time frame. And some data might be very important, top secret for example.

2) Who are you trying to protect the data from?

For example, if you are trying to protect against the average computer user then the level of protection required is low. If you are trying to protect against committed and competent hackers then a different, much higher level of protection is required.

3) For how long is the protection necessary?

All data in the hands of a competent hacker will be compromised eventually but it's a question of time. if the protection you apply can survive the attack for long enough that the data becomes worthless then the protection was sufficient. For example, public company accounts are only secret until their official release into the public. They only need to survive an attack until the data was going to be released publicly anyway.

So, in sum, you need to think about: (1) What data to protect, (2) against who, and (3) for how long. This will help you understand the level of protection you need to consider.

If you have very critical secret data you might consider hosting that part of the data on a server which your local app queries and only after a user provides acceptable login details to the server. In this way you can control who has access to the data and can log how often that data is queried and whether that query is acceptable etc. etc.

Hi JP,

Thank you for your explanation.

My only concern is that people that have access tot the sourcecode can read the passwords used to protect the files.
So what we want is to keep out the password from the sourcecode. That's why I got the idea to store them in a separate
component. I don't know excactly how they work, but that shouldn't be to hard. The question is, can data be exchanged between the mainprogram and the component. So when I use a component with hPass(Filename), can this be handed over to the mainprogram.

Maybe I understand the use of components in a wrong way, so then it's no option.

Best regards,

Aad



Edited 3 time(s). Last edit at 12/28/2021 04:46PM by AadG.

AadG

There is no hiding a password in an app which a competent hacker has direct access to regardless of whether you access it via a component or otherwise. That must be accepted. If he has direct access he will attach a debugger and other memory scanning tools and simply intercept the password or the result of password's usage i.e. the data. So then the question is who are you trying to protect yourself from.

If it is the competent hacker then you must redesign the app to probably be a server based solution where users cannot directly access the system but rather only via a "dumb terminal" type arrangement i.e. a browser based solution or terminal server solution with no direct access to the code, database, or executing memory.

If it is the average user then the built-in protections of WinDev will likely be sufficient since the average user has no knowledge about how to circumvent those protections.

And how sensitive is the data you are trying to protect? Does it really require the level of security you imagine it does? Often I have seen attempts to protect code and data that really just are not that sensitive. If it really is that sensitive then again a cloud based solution with no direct access might be more appropriate.