License and Scripts Protection

[SkyFrontier]

Is there a way to mask a script by "*", even spaces being replaced so one simply CAN'T see anything of what's inside? And what about applying the same to XY license (which is partially protected)?

The idea can go more deeply so XY should be able to translate a value into some useless random value when writing into XY .inis and interpreting then correctly when interfacing with user. Editing mode could be password protected, so when in need of editing the user could have an option to enable/disable for each script he needs.

Considering it's PORTABLE, this should be of a great importance. Hint of usage: one could fake label a script containing a password to enter a site so another person could not figure out what's inside. So just run the site and after that the proper script to paste password into clipboard. I bet it's not that hard but could add more to the script usage outside XY. Ideally, even the execution of a script could ask for a password. What about...?

Currently I use internet cafe to connect having XY on top of a pen drive, that's why I concern on that matter. Even the "status" message on Statusbar I try to cover, but having a real option to completely turn off the script statuses at least would be of a great help. Losing pen drive is not a concern, but having it stolen currently is. Taking all of this into account I see it's time for such measures to be discussed.

[lukescammell]

Hmm, I'm not sure this really should be handled by XY. Encryption is a slippery bugger at the best of times so "just tacking it on" isn't the best plan. If you are worried about losing or having your pen drive stolen, just encrypt it using something like Trucrypt.

No offense to Don, but leave encryption to the specialists.

[SkyFrontier]

No "hardcore" encryption involved, just masking/character replacing in fact.
I've tested apps that show characters which are not the real characters - there's some internal function to encode/decode so what one see is not the real thing.

Even registry values can be "encrypted" that way, making it hard to steal reg values.

So XY license "xy0100" could be shown as "xyABFG",

Code: Select all

copytext "12345"

could be

Code: Select all

copytext "abdhl"

and Manage Commands could ask for a master password and so on.

Also an option to silence the statusbar would be fine, as currently I have to

Code: Select all

status: "Done!"

-but I am still able to see for a second that something is going on, and that could be recorded for a monitoring program!

[SkyFrontier]

Considering recent changes:

Code: Select all

v9.30.0023 - 2010-07-29 12:14
...
    + Scripting got a new function.
      Name:   replacelist
...

and a new approach on scripts' protection deriving from it, I'm still worried about wandering with pen-drives and notebook... is it possible to include at least a prompt for a master password at each XY startup, if one desires it so?

[SkyFrontier]

-near-obvious reason: I am giving XY a core role on my portable systems. Then via portable file associations I am setting "pseudo-extensions" to view .txt as txt when launched through XY and externally viewed by a video player, for instance - which means one will not easily know what's happening behind the scenes (of course this will not fool experts, but it's a step on hiding key files from a stealer in case of such accident, or simply losing a pen-drive around...)
-non-obvious reason: I foresee a day when I can enable/disable a function that tells XY to interpret given expressions as anything else, so I can name a file:

Code: Select all

read me.txt

and it will be seen as that by any other app. BUT after enabling such option, previously set (capitalization matters, so any other "Read Me" can be ignored and seen as it is...) "read me=Client X Presentation" will throw (of course!)

Code: Select all

Client X Presentation.txt

Currently I do similar thing via Tags/Find Tags. But it's risky, if one guess out of the blue a little hint on what's happening.
Call me paranoid, but I care on mine/others data privacy.

[vegard]

Trucrypt.

[SkyFrontier]

Thanks, vegard.
But:
-involves a radical take on if you want to seriously have it up and running;
-it's too obvious... even TrueCrypt raises plausible deniability discussions;
-it's a software based approach: if the software fails, the things turn into a more serious problem to deal with...;
-I am thinking on a soft approach that requires almost zero intervention on the user's side once it's configured.

[SkyFrontier]

...also, I am using "encryption" on a more wide sense, in means of its greek relative "Cryptography", "hidden writing".

[vegard]

Maybe you have misunderstood what truecrypt is.

You create an encrypted file.
You mount it.
You put your stuff there.

I don't see what makes this radical.

[SkyFrontier]

Vegard:

Maybe you have misunderstood what truecrypt is.

The possibility of software failure/security breaches are the main reasons why I am avoiding such a radical option.
Converting XYplorer in a sort of "key decryption/security center" also tells me about creativity and makes no real changes to anything. Fast, stable, all under my control, all "invisible" even to an expert, at a first sight. I like that.
But... thanks for the tip!