|
|
Post by egghead on Sept 1, 2018 7:12:40 GMT
In build.yml I see :
# encrypt_file_extensions:
# - html
# - js
# - css
# - iseq
What does this do, exactly?
|
|
|
|
Post by Dmitry Soldatenkov on Sept 1, 2018 18:20:10 GMT
|
|
|
|
Post by egghead on Sept 2, 2018 4:32:59 GMT
Nice, thanks. Is it 256-bit encryption and does it impact app performance in any way?
Besides the 4 file types, can other file types also be specified? For example *.txt
|
|
|
|
Post by Dmitry Soldatenkov on Sept 2, 2018 9:13:59 GMT
Alg is AES-256-CBC
We do not make any performance tests, but some our customers use it in their applications.
You can define any file extensions - those four is just example and recommendation
|
|
|
|
Post by egghead on Sept 2, 2018 14:51:29 GMT
I might need to package some master data in text files along with my app such that when the app starts for the first time, the data will be populated in the apps's sqlite database. So if I encrypt both the database as well as the text files, will there be any problem?
|
|
|
|
Post by Dmitry Soldatenkov on Sept 2, 2018 18:31:55 GMT
|
|
|
|
Post by egghead on Sept 3, 2018 5:16:34 GMT
Thanks, Dmitry.
Currently, I have this code snippet in application.rb to populate States data on app start (States data in state.txt in JSON format):
#Seed the database with initial State data
catalog = State.find(:all)
if catalog.empty?
fileName = File.join(Rho::RhoApplication::get_base_app_path(), '/public/state.txt')
lines = File.read(fileName)
jsonContent = Rho::JSON.parse(lines)
jsonContent.each {
|json|
State.create("state_code" => json['state_code'],
"state" => json['state'],
"website" => json['website'])
}
else
#Rho::Notification.hidePopup
#The catalog has been loaded already there is nothing to do
end
Any tips on where I should insert decrypting code, assuming state.txt as well as DB are both encrypted?
Thanks
|
|
|
|
Post by Dmitry Soldatenkov on Sept 3, 2018 17:26:33 GMT
In case of both TXT files and DB encrypted, you should decrypt "lines" after this line:
lines = File.read(fileName)
|
|
|
|
Post by Alex Epifanov on Sept 3, 2018 17:47:24 GMT
|
|
|
|
Post by egghead on Sept 4, 2018 0:51:13 GMT
Thanks Dmitry for the tip. And Alex for the documentation. I was searching for it
|
|
|
|
Post by Dmitry Soldatenkov on Sept 5, 2018 5:03:27 GMT
|
|
|
|
Post by egghead on Sept 5, 2018 6:24:58 GMT
Thanks, Dmitry. I will try it out today (hopefully). Couldn't build for Android so far as I always get a corrupted NDK zip file when downloading. I'm retrying...
|
|
|
|
Post by jontara on Sept 5, 2018 17:39:29 GMT
Thanks, Dmitry, I will try this!
Currently, I work around this limitation by embedding some JSON data in Ruby modules. I have some pre-build code that incorporates a JSON file if present in a model into a constant in the model. (And then the JSON file itself isn't included in the bundle.)
Note there is still a security issue for some file types when using iOS with WKWebView or when using Android. (Some of) files will be simply decrypted by knowing the assigned port number and accessing the Rhodes server from on or off device (on local network). If using UIWebView, though, you can use the iosDirectLocalRequests=1 option in rhoconfig.txt and then there is no real server and no bound port.
I have not experimented with decrypting irb files by just accessing the server. But I have proven it with e.g. /public/ files. For controllers, I think the server would just EXECUTE the controller code. But e.g. /public/ files have limited protection because of this workaround.
However, with BundleDecrypter, you can decrypt files that are placed in a directory which is not accessible by the Rhodes server. The problem remains with your .erb/.rb and public/ files (you can encrypt your JS/CSS as well).
Note you will need to store the key somewhere in the app, so store it carefully, so that it is not so easily found. That said, the .iseq files are COMPILED Ruby bytecode, and can themselves be encrypted, so would resist static examination of the bundle files.
It is wise to generate a new key for every build. I do that as part of a pre-build process. If somebody does find the key, it will only work with that given version for a given platform (e.g. iOS/android/etc.)
|
|
|
|
Post by jontara on Sept 5, 2018 17:53:29 GMT
Oh, I just got an idea about how to place some files in models and not expose them via the server. I think you have to play some games with the file extension, though. It can only be a .erb. So, say you have some JSON data, you can lie and call it e.g. secret_stuff.json.erb Now, make a "do-nothing" controller method: def secret_stuff '' end If somebody gets the port number, and knows what file to look at, they will get nothing. Note, though, the fact of the server listening on a port is a general security problem, as somebody can still call controller methods. On iOS, you can avoid the problem by using UIWebView and ios_direct_local_requests=1. You can probably do some clever things with code overriding Rho::RhoController as well. Even if imperfect, it is a good step to have critical data encrypted at rest. Within a few days of publishing on Google Play Store, you will find copies of your .apk on many download sites! People can just download the .apk and examine it. (And, anyway, it is easy enough to get the .apk anyway.) You can use the DeviceSecurity API, BTW, to lock-down your app so that it will only run if it was installed from the Play Store. docs.tau-technologies.com/en/6.0/api/DeviceSecurityIn this case, I think it's best if the app simply dies, rather than offering an error message. You will have to make sure any help desk, etc. knows, and knows what questions to ask. We already had one student report our app "doesn't work" at startup. It turns out they install all of their Android apps through a third-party "store". It turns out there are some people who out of suspicion, maybe disagreements with Google policy, etc. prefer not to install from Play Store. You have to decide to weigh the risk against inconvenience for some users. If you let users install from anywhere, they don't really know what they are getting! |
|
|
|
Post by egghead on Sept 8, 2018 3:15:20 GMT
I just did these settings in build.yml : encrypt_files_key: "aH9D52xfJJ89xgi3gGWTNmO0PU0rV8aHmm/P4tGHApM=" # enable encrypt of database #encrypt_database: 1 encrypt_file_extensions: # enable encryption of bundle by AES (only for iOS and Adnroid) # key should be generated by this command: # $ rake build:bundle:generate_AES_key - txt And I just dumped a simple text (.txt) file in /public folder and tried to build, but its not building successfully : [INFO] build:bundle:noxruby| Running compileRB apps/app/helpers/bundle_decrypter.rb:1: syntax error, unexpected $undefined, expecting '}' {\rtf1\ansi\deff0\nouicompat{\fonttbl{\f0\fnil\fcharset0 Calibri;}} ^ apps/app/helpers/bundle_decrypter.rb:2: syntax error, unexpected $undefined, expecting '}' {\*\generator Riched20 10.0.17134}\viewkind4\uc1 ^ apps/app/helpers/bundle_decrypter.rb:2: unexpected fraction part after numeric literal {\*\generator Riched20 10.0.17134}\viewkind4\uc1 ^ apps/app/helpers/bundle_decrypter.rb:2: syntax error, unexpected $undefined, expecting end-of-input {\*\generator Riched20 10.0.17134}\viewkind4\uc1 ^ E:/cryptodemo/bin/tmp/assets/compileRB.rb:44:in `compile_file'compile errorSyntaxError from E:/cryptodemo/bin/tmp/assets/compileRB.rb:44:in `block in <main>' from e:/RhoMobileSuite6.0.11/ruby/lib/ruby/gems/1.9.1/gems/rhodes-6.0.11/lib/framework/find.rb:41:in `block in find' from e:/RhoMobileSuite6.0.11/ruby/lib/ruby/gems/1.9.1/gems/rhodes-6.0.11/lib/framework/find.rb:40:in `catch' from e:/RhoMobileSuite6.0.11/ruby/lib/ruby/gems/1.9.1/gems/rhodes-6.0.11/lib/framework/find.rb:40:in `find' from E:/cryptodemo/bin/tmp/assets/compileRB.rb:39:in `<main>' [INFO] build:bundle:noxruby| rb compilation failed: E:/cryptodemo/bin/tmp/assets/apps/app/helpers/bundle_decrypter.rb Oct 19 2017 20:25:10 >>>>> RUNNING RUBY COMPILER >>>>> WORK DIR e:\RhoMobileSuite6.0.11\ruby\lib\ruby\gems\1.9.1\gems\rhodes-6.0.11 >>>>> ARGS: res/build-tools/RhoRuby.exe -E UTF-8 -Ie:/RhoMobileSuite6.0.11/ruby/lib/ruby/gems/1.9.1/gems/rhodes-6.0.11/lib/framework E:/cryptodemo/bin/tmp/assets/compileRB.rb [INFO] build:bundle:noxruby| Error interpreting ruby code **** WARNING ************************************************************************************************* The following extensions do not have JavaScript API: openssl, digest Use RMS 4.0 extensions to provide JavaScript API ************************************************************************************************************** |
|
