Home/ Questions/Q 6107831
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-23T14:13:53+00:00

what’s the best way to hide/protect a string that contains my server IP address

  • 0

what’s the best way to hide/protect a string that contains my server IP address in C# winforms application?

here is the thing, in order to activate the application I created, the user should fill up some form that contains username and password textboxes and then connect to my server in order to verify his entered details.

now what I want is to hide/protect or maybe somehow encrypt the string that contains the server address so no one can actually change/access it or at least make it very hard to be reversed.. is that possible?

I’m not sure if I’m clear with the question but I hope you guys got the idea..

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This is a ludicrous approach. Security through obscurity is very weak to begin with, and the IP address you’re connecting to doesn’t just show up in your source code, but in outgoing packets, firewall logs, connection tables, packet captures, etc.

    Hiding the peer IP address of a connection is a big area of interest and leads to techniques such as onion routing. Hiding the address in your source code is the least of your worries. And when you do use onion routing, the destination IP address won’t even appear in your source code, only some cookie that is meaningful only to the next-hop onion router, so obfuscating source code becomes a non-issue.

    EDIT: Based on comments, it’s now clear that what’s wanted is verification of the identity of the remote computer sending a response. There are ways to accomplish that, but protecting source code is not one of them. IP addresses can be spoofed, and easily. A public key stored in your application binary can be overwritten, or the authentication code can be bypassed completely.

    Really, you’d need some vital function in your program to not be included in the installer, but downloaded as part of the authentication process (then the server can choose not to send it if authentication fails). There’s still a possibility that the response can be stolen and used to activate additional installs without authentication, but this can only be done by someone who could validly authenticate at least once.

    If you’re worried about that, then you’d need to use steganography to encode the client’s identity in the response. Then when illicit copies start appearing, you know which valid user made the first copy.

    Or keep the proprietary parts of your software on your server, and don’t ever download them to the client. This is the safest method.

    • 0