# Protecting Secret Keys from Hackers **URL:** \ **Category:** General\ **Created:** [April 12, 2021, 10:46am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667 "2021-04-12T10:46:28Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Stephen\_Dodd](https://forum.xojo.com/user_avatar/forum.xojo.com/stephen_dodd/32/530_2.png) [@Stephen\_Dodd](https://forum.xojo.com/u/Stephen_Dodd)\ **Post date:** [April 12, 2021, 10:46am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/1 "2021-04-12T10:46:28Z")
If you have sensitive login information to a service, how to you protect it in code from people who might decompile your app? For example, I have code like this that talks to AWS. How would I protect my secret key? I could encrypt the property locally but it would have to be decrypted before it was used to login (via the handy MBS Curl utility) and that presumably would make it insecure. ``` // Prepare the cURL for the S3 API call. Dim CurlSetup As Boolean = Curl.SetupAWS( AccessKey, SecretKey, Region, Service, Path, Domain, Verb, HashedPayload, Headers ) ``` ---
**Author:** ![Greg\_O\_Lone](https://forum.xojo.com/user_avatar/forum.xojo.com/greg_o_lone/32/49_2.png) [@Greg\_O\_Lone](https://forum.xojo.com/u/Greg_O_Lone)\ **Post date:** [April 12, 2021, 10:53am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/2 "2021-04-12T10:53:31Z")
One easy way to do this is to make a method and convert the entire string to chr() calls. If you want to add another layer, use an array and jumble the order when the array is created and sort them out before returning. ---
**Author:** ![Beatrix\_Willius](https://forum.xojo.com/user_avatar/forum.xojo.com/beatrix_willius/32/282_2.png) [@Beatrix\_Willius](https://forum.xojo.com/u/Beatrix_Willius)\ **Post date:** [April 12, 2021, 10:57am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/3 "2021-04-12T10:57:05Z")
[https://thezaz.com/code/obfuscate/](https://thezaz.com/code/obfuscate/) > [@Obfuscation](https://forum.xojo.com/t/obfuscation/16877/53): > > To be technical about it, it is spelled “libgishlickly”. ---
**Author:** ![Stephen\_Dodd](https://forum.xojo.com/user_avatar/forum.xojo.com/stephen_dodd/32/530_2.png) [@Stephen\_Dodd](https://forum.xojo.com/u/Stephen_Dodd)\ **Post date:** [April 12, 2021, 10:58am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/5 "2021-04-12T10:58:04Z")
But even if I did something like that: ``` SecretKey = chr(1) + chr(2) + chr(3) // etc Login(Name, SecretKey) // SecretKey now exists in memory as clear text ``` Then the SecretKey exists in memory decoded in plain text at this point. Couldn’t that then be viewed by a hacker? ---
**Author:** ![Greg\_O\_Lone](https://forum.xojo.com/user_avatar/forum.xojo.com/greg_o_lone/32/49_2.png) [@Greg\_O\_Lone](https://forum.xojo.com/u/Greg_O_Lone)\ **Post date:** [April 12, 2021, 10:59am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/6 "2021-04-12T10:59:29Z")
Only for the moment that the string is in use. Make sure it goes out of scope or is set back to an empty string immediately after use. ---
**Author:** ![Stephen\_Dodd](https://forum.xojo.com/user_avatar/forum.xojo.com/stephen_dodd/32/530_2.png) [@Stephen\_Dodd](https://forum.xojo.com/u/Stephen_Dodd)\ **Post date:** [April 12, 2021, 11:01am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/7 "2021-04-12T11:01:44Z")
Oh, thanks to you and @Thom_McGrath. That’s a snazzy utility! Doesn’t solve the in-memory viewing but does make things more difficult for a hacker. ---
**Author:** ![Stephen\_Dodd](https://forum.xojo.com/user_avatar/forum.xojo.com/stephen_dodd/32/530_2.png) [@Stephen\_Dodd](https://forum.xojo.com/u/Stephen_Dodd)\ **Post date:** [April 12, 2021, 11:03am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/8 "2021-04-12T11:03:18Z")
Ok. Thanks. I guess its better than no protection. Why do I feel like there’s a NSFW coding joke waiting in here… ---
**Author:** ![Sam\_Rowlands](https://forum.xojo.com/user_avatar/forum.xojo.com/sam_rowlands/32/265_2.png) [@Sam\_Rowlands](https://forum.xojo.com/u/Sam_Rowlands)\ **Post date:** [April 12, 2021, 11:15am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/9 "2021-04-12T11:15:56Z")
Just bear in mind, before you go too deep into the rabbit hole. Whatever you do, can be seen by an experienced hacker. Some protection is good as it cuts down the number of people who can extract secret keys, but not all. By the way, please change it! “12345” is the same combination as my luggage 😉 ---
**Author:** ![Stephen\_Dodd](https://forum.xojo.com/user_avatar/forum.xojo.com/stephen_dodd/32/530_2.png) [@Stephen\_Dodd](https://forum.xojo.com/u/Stephen_Dodd)\ **Post date:** [April 12, 2021, 11:18am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/10 "2021-04-12T11:18:18Z")
That’s some mighty secure luggage. Wasn’t the code for the nuke launch at one of the bases 1111? ---
**Author:** ![Greg\_O\_Lone](https://forum.xojo.com/user_avatar/forum.xojo.com/greg_o_lone/32/49_2.png) [@Greg\_O\_Lone](https://forum.xojo.com/u/Greg_O_Lone)\ **Post date:** [April 12, 2021, 11:18am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/11 "2021-04-12T11:18:48Z")
Also, make sure you are solving a problem that you actually have. As Sam said, an experienced hacker can access anything they want to, but that also usually means physical access to the machine, which also means having had compromised one of the humans that use that machine, etc. ---
**Author:** ![Stephen\_Dodd](https://forum.xojo.com/user_avatar/forum.xojo.com/stephen_dodd/32/530_2.png) [@Stephen\_Dodd](https://forum.xojo.com/u/Stephen_Dodd)\ **Post date:** [April 12, 2021, 11:20am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/12 "2021-04-12T11:20:21Z")
Well, I’m assuming that my compiled app freely available to download could be disassembled and the memory contents viewed in an assembler IDE…? ---
**Author:** ![Hans-Norbert\_Gratzal](https://forum.xojo.com/user_avatar/forum.xojo.com/hans-norbert_gratzal/32/2143_2.png) [@Hans-Norbert\_Gratzal](https://forum.xojo.com/u/Hans-Norbert_Gratzal)\ **Post date:** [April 12, 2021, 11:28am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/13 "2021-04-12T11:28:40Z")
[https://www.pelock.com](https://www.pelock.com) stops hackers from even debugging the source code ---
**Author:** ![Stephen\_Dodd](https://forum.xojo.com/user_avatar/forum.xojo.com/stephen_dodd/32/530_2.png) [@Stephen\_Dodd](https://forum.xojo.com/u/Stephen_Dodd)\ **Post date:** [April 12, 2021, 11:30am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/14 "2021-04-12T11:30:27Z")
Interesting. Pity its only 32 bit Win apps. ---
**Author:** ![Greg\_O\_Lone](https://forum.xojo.com/user_avatar/forum.xojo.com/greg_o_lone/32/49_2.png) [@Greg\_O\_Lone](https://forum.xojo.com/u/Greg_O_Lone)\ **Post date:** [April 12, 2021, 11:33am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/15 "2021-04-12T11:33:37Z")
Yes, that’s true, but is it readily obvious that your app does this and is the information sensitive enough that a hacker is going to seek it out and use it nefariously? Dealing with hackers is always a balancing act. To put it simply, you need to make it complicated enough that they realize that there are other easier targets in terms of time and reward, but not so complicated that you spend all of your life protecting it from them. Think of alarm system signs on a house. If someone were to see one in your yard, that’s often enough to have them move on to another location without even checking to see if you are home because there are other homes with equally valuable things in them which don’t have intrusion detection systems. Unless they know that you have something that no one else has and which they _really_ want. Same as hackers. ---
**Author:** ![MarkusR](https://forum.xojo.com/user_avatar/forum.xojo.com/markusr/32/685_2.png) [@MarkusR](https://forum.xojo.com/u/MarkusR)\ **Post date:** [April 12, 2021, 8:23pm UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/16 "2021-04-12T20:23:14Z")
keep in mind that a dll can be replaced by a dll with the same name and methods to read all parameters. and this special dll call the real dll methods then. you will not notice this. instead of giving all apps/users the same “password” its better that each user have its own login or secret. ---
**Author:** ![Greg\_O\_Lone](https://forum.xojo.com/user_avatar/forum.xojo.com/greg_o_lone/32/49_2.png) [@Greg\_O\_Lone](https://forum.xojo.com/u/Greg_O_Lone)\ **Post date:** [April 12, 2021, 8:35pm UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/17 "2021-04-12T20:35:54Z")
or perhaps using your own Web API on a server somewhere and access AWS that way. ---
**Author:** ![Christian\_Schmitz](https://forum.xojo.com/user_avatar/forum.xojo.com/christian_schmitz/32/158_2.png) [@Christian\_Schmitz](https://forum.xojo.com/u/Christian_Schmitz)\ **Post date:** [April 12, 2021, 10:12pm UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/18 "2021-04-12T22:12:38Z")
Don’t put your keys in the app. Have the app talk to your server to authenticate user and send files to your server, which stores them. Or for direct upload generate temporary logins or presumed upload urls. ---
**Author:** ![Stephen\_Dodd](https://forum.xojo.com/user_avatar/forum.xojo.com/stephen_dodd/32/530_2.png) [@Stephen\_Dodd](https://forum.xojo.com/u/Stephen_Dodd)\ **Post date:** [April 13, 2021, 9:21am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/19 "2021-04-13T09:21:44Z")
So for every call to AWS, my desktop app would have to talk to a custom web app to relay the information? That kinda feels like it defeats the purpose of AWS… ---
**Author:** ![Christian\_Schmitz](https://forum.xojo.com/user_avatar/forum.xojo.com/christian_schmitz/32/158_2.png) [@Christian\_Schmitz](https://forum.xojo.com/u/Christian_Schmitz)\ **Post date:** [April 13, 2021, 9:37am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/20 "2021-04-13T09:37:52Z")
With pre-signed upload URLs, you could query your web app, send a request, get back a JSON with the URL inside and then do the upload to S3 directly. ---
**Author:** ![Stephen\_Dodd](https://forum.xojo.com/user_avatar/forum.xojo.com/stephen_dodd/32/530_2.png) [@Stephen\_Dodd](https://forum.xojo.com/u/Stephen_Dodd)\ **Post date:** [April 13, 2021, 9:56am UTC](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667/21 "2021-04-13T09:56:27Z")
Hmmm. One of the reasons I’m using AWS is because I’m hammering it with dozens (later hundreds) of read requests a second and its cheap. So my on web app would have to generate all those URLs each time? [Next page](https://forum.xojo.com/t/protecting-secret-keys-from-hackers/62667.md?page=2)