I am working on an offline SPA app (which will obviously use only local files) which has my main data, a large array of strings, stored in a js file that is loaded with the page. The data is UTF8 (Khmer). I am looking for a way to create a cipher so that the text can be stored in the array in this js file relatively securely. Then, I need to decrypt the strings on the fly using an algorithm that the user cannot ‘crack’ just by looking at the js source, i.e. I need to hide the algorithm. I know this a broad question, but seeing I am working offline, I can’t have access to local files (which could be easily encrpyted) using js. Thanks for any help.
Share
Encrypt the data with whatever key and algorithm you like. Obsfucate your js code with one of many, many obsfucators out there.
Note that anyone who can read js code and can run a prettifier script will be able to figure out what you’re doing and extract the data himself, but that’s about as far as you can get with just software.
An extra hurdle for the attacker could be made if you store the key off-site (ie, your own server), which the client requests and retrieves at run-time. The attacker can find the key easily using a packet sniffer and turning on the program, but that’s one extra step in your “security by this is not worth my time.”