SWF files and security?

[Dimitar]

Could someone know a good decision for secured swf file, doesn't matter
generated on the fly from Flex App Server or other environment? What I mean,
is that SWF files are downloaded locally on the client machines (including Flex
RIAs) and then executed from there. Now if there are transactions with
important info like credit card info, etc. passing by from server to the swf
file, isn't it pretty easy to decompile the swf file and take a nice detail
look how things work. FOr example. SUppose there is a Flex application
(means generated on the fly SWF file/files) to be used. And inside the SWF
files there are some client-side validations for vital info, after that this
info is posting back to the Web server. The issue is, SWF files are easy to be
decompiled in very readable code, at least that's my experience. My question:
Can we encrypt the whole SWF file loaded from Flex Application server, not only
to use a SSL connection for transactions, data and so. In this way the clients
who are using Flex RIAs will not have the chance to decompile and see what's
inside the SWF files coming from the Flex Server. Hope someone could realise
my point and answer in a simple and detail manner. Thanks, Dimitar

[bdeen]

This is basic file management. An swf is just another file type, like html or
a video, it gets downloaded via http or https (that would be http with ssl).
So yes you can make sure that the swf is downloaded through an ssl channel.
The protocl of http and https is the same it's just the content that has been
changed. Also may I suggest that you don't do anything other then the most
basic validation, such as the first 4 digits with the type of card. Nothing
specific to your application, that should be left to be done on the server. A
good rule of thumb is to validate what you would validate with javascript.
Also with your flex apps, you should use GZip compression when possible, as
well as ssl to communicate to the server. In my JRun 4 production servers I
have a secure filter that runs ontop of everything the JRun servers serves up.
I also put a GZip filter ontop of every flex remoteobject/web service I create.

[DreamFly]

Hi, It's easy, visit [url]http://www.dreamflysoft.com[/url] and download Cool
File Encryption to help you.

[Unregistered]

You can protect your SWF files. One of the best is SWF protector from Dcomsoft. You can download free trial version SWF protector here http://www.dcomsoft.com