Develop demo application
-
Well, security is often associated with paranoia, and I'm not trying to convince anyone here.
My opinion is that your application should not try to encrypt data that is going to store where other encryption is available. For a typical database example, even an item price does not have to be encrypted in the database. You application must talk with SSL to the database, the database can store it in encrypted columns, but your application does not have to. Other scenarios of course could require a stronger environment.
Another point is that you are an application developer, so you have to trust the execution environment you are running on. This does not mean that you don't have to verify data, but verifying is much more different than encrypting them. And that is why I proposed to use a virtual machine, that can easily be configured to be a trusted environment. I don't believe virtualization adds security, but for a demo it will surely make things simpler than developing a protection mechanism at the application level. But hey, this is my opinion.
This discussion reminds me the DRM battle.... -
[quote author="fluca1978" date="1316774989"]Well, security is often associated with paranoia.[/quote]
Well, you should probably tell that those 70 million people whose credit card numbers were stolen from the PSN because they were stored unencrypted in a database ;-) -
This is not a strict problem of the application, but of the database. Again, there is data that must be stored encrypted, but encrypting it in the application when it can be in the storage does not sound good to me.
-
[quote author="fluca1978" date="1316779404"]This is not a strict problem of the application, but of the database. Again, there is data that must be stored encrypted, but encrypting it in the application when it can be in the storage does not sound good to me. [/quote]
We are still talking about data related to the software protection here, not data in general, aren't we?
[quote author="Lukas Geyer" date="1316772273"]Not all data concerning the application has to be encryted - but all data concerning the software protection has to (no exceptions), independent of its location (memory or disk).[/quote]
-
[quote author="Lukas Geyer" date="1316780193"]
We are still talking about data related to the software protection here, not data in general, aren't we?
[/quote]
Not sure what you are talking about, since I guess your example is about data protection, not application protection.
Anyway, this thread demonstrates again that it is difficult even to talk about this kind of software protection (I mean demo locks).