Making a line of code difficult to read..

Question

Im writing a way of checking if a customers serial number matches my hard coded number. Is there a way of making this as hard to read as possible in case an undesirable gets their hands on the code?

I am working in java.

For instance (pseudo code)

if (x != y) jump out of code and return error

Cheers , apologies if this is a bit of an odd one

Answer 1

Making the code look complex to avoid being hacked never helps!

Answer 2

Tangle the control structure of the released code?

e.g feed the numbers in at a random point in the code under a different variable and at some random point make them equal x and y?

http://en.wikipedia.org/wiki/Spaghetti_code

Answer 3

There is a wikipedia article on code obfuscation. Maybe the tricks there can help you =)

Answer 4

Security through obscurity is always a bad idea. You don't need to avoid it, but you should not trust solely on it.

Either encrypt your serials with a key you type in at startup of the service, or just specify the serials as hex or base64, not ASCII.

Answer 5

Instead of trying to make the code complex, you can implement other methods which will not expose your hard-coded serial number.

Try storing the hard coded number at some permanent location as encrypted byte array. That way its not readable. For comparison encrypt the client serial code with same algorithm and compare.

Answer 6

If the number is large enough and is an integer instead of an alphanumeric string:

1 + 1 + 1 + ... (n times)

Or even mix and match operators:

1 - 1 + 1 * ... (as many times as it takes)

(Purely tongue-in-cheek.)

Answer 7

The normal way to do this would be to use a hash.

1. Create a hash of your serial code.
2. To validate the client serial, hash that using the same function.
3. If the hashes match, the serial was correct, even though the serial itself was not in the code.

By definition, a from the hash it's almost impossible to deduce the original code.

Answer 8

You can try SHA1 or some other one-way encrypting (MD5 not so secure but it's pretty good). Don't do this:

if (userPassword equals myHardCodedpassword)

Do this:

if (ENCRYPTED(userPassword) equals myhardcodedEncryptedpassword)

So the code-reader only can see an encrypted (and very very very difficult to decrypt) value.