current community

your communities

more stack exchange communities

Stack Exchange
tour help
Take the 2-minute tour ×
Computer Science Stack Exchange is a question and answer site for students, researchers and practitioners of computer science. It's 100% free, no registration required.
up vote 14 down vote favorite
4

I have finished developing an app for Android and intend to publish it with GPL -- I want it to be open source. However, the nature of the application (a game) is that it asks riddles and has the answers coded into the string resource. I can't publish the answers! I was told to look into storing passwords securely -- but I haven't found anything appropriate.

Is it possible to publish my source code with a string array hidden, encrypted, or otherwise obscured? Maybe by reading the answers from an online database?

share|improve this question
    
See this –  Digital Brain 21 hours ago
2  
I wonder how ontopic this is here; it may be better suited to Information Security in any case. –  Raphael♦ 20 hours ago
    
@Raphael Given the upvotes, I think it has been voted ontopic, just as there are many computer science questions over on math.se. –  Yuval Filmus 5 hours ago

5 Answers 5

up vote 21 down vote

You have at least two options, depending on what problem you want to solve.

If you want innocent readers of your code to not get the answers inadvertently, or you at least want to make it a bit difficult so that users are not tempted, you can encrypt the solutions and store the key as part of your code, perhaps a result of some computation (to make it even more difficult).

If you want to prevent users from retrieving the answer, you can use a one-way function, or in computer jargon, a hash function. Store a hash of the answer, and they you can test whether the answer is correct without it being possible to deduce the answer at all without finding it first. This has the disadvantage that it is harder to check for an answer that is close to the correct answer, though there are some solutions even to this problem.

share|improve this answer
3  
One thing I'd add is that if you need even more security, each answer should probably be salted with a different salt. This avoids a dictionary attack against all answers at once. If you want to see how the "real" crypto people do it, take a look at the String-to-Key system in OpenPGP. –  Pseudonym yesterday
    
Keeping hashes in code means all information is static and salt/whatever else will be readily available too. I believe as result it would be reasonable if answer space is large enough (like full range of 32-bit integer values), otherwise (i.e. in case of multiple choice questions) rainbow table would quickly give correct answers. –  Alexei Levenkov 21 hours ago
1  
As Alexei points out, if your possible inputs span a small space, storing the answers in the code will open them up to any determined attacker - and I'm guessing most riddles will have rather small state spaces, in that their answers generally must be either words or relatively small numbers. You can hash or encrypt to avoid innocent mistakes, but there's no preventing somebody from getting the answer who really wants it. (Plus, they could just ask somebody who already solved your riddle!) –  Chris Hayes 20 hours ago
1  
To counter what Chris is mentioning, you can choose a hashing process that is very slow, say it takes 100ms (that's the approach taken by some PK standards). This is still very fast from the user's perspective, but makes enumeration much more difficult. –  Yuval Filmus 19 hours ago
3  
@YuvalFilmus Again, to an extent. If your riddle ends in "Was Jan, Joe or Jane the criminal?" then it's going to be very easy to enumerate even if you make the hash take a full minute. Unless the entire game is written with this in mind, and all of the questions are extremely open-ended, this will pose a problem. But yes, if your questions are that open-ended that the state space is sufficiently large, the answers can be protected. –  Chris Hayes 19 hours ago
up vote 9 down vote

You have two options

Keep the answers separate from the rest of the source code

If you want your code to be open source however dont want the answers to be open source, then you open source the code for the application without the questions & answers, with the questions & answers being a separate closed source "plugin" or data file. Your Android app would bundle both of these together into a single app.

Put the answers in your source code

Alternatively, if you consider the questions and answers to be a core part of what you want open sourced then you should put the answers into the source code, preferably un-obfuscaed so that others can read and modify them. Obfuscating source code so that it can't be understood and modified isn't really in keeping with the principles of open source code.

If you are looking for ways to obfuscate your answers the that suggests to me that you don't really want to open source your answers in the first place, so you should consider the first option.

share|improve this answer
2  
The Q&A doesn't even have to be a plugin, it can be a simple data file. Input data files are not necessarily included as part of the licensed software and can be covered under their own separate license. As long as you provide a (different) sample data file to use with the source code, you are not obstructing free use of the source or programs compiled from said source, and thus should not be in violation of the GPL. –  Doktor J 6 hours ago
up vote 2 down vote

If the object is to obscure strings from casual reading of the source code but keep them open so other people can easily make their own changes - for example if you were publishing the source to a text adventure and didn't want any descriptive text to appear which would constitute a spoiler, then use something reversible like rot13.

In fact, you could rot13 all your translation files and flip them back on the fly.

That's keeping the open spirit. Random "magic" hashes isn't really programmer-friendly.

share|improve this answer
2  
Remember that many GeoCaching folks amongst us read rot13 almost as fluently as the original. –  tohecz 12 hours ago
up vote 2 down vote

Why would you store your answers in your GPL source code if you don't want your users to know them? Even if they're not known or easily crackable now, they can (and likely will) be in the future.

Instead of storing them in your app, use an external database. Make a small web service that compares the answers to what's in your database. Then let your application make a call to that webservice whenever it has to verify. The main problem is that, because it requires internet access, you will lose some speed and potential userbase. your app license should only apply for the app itself, not the webservice.

You could also just put your answers in a small database and put that in your program. As far as I know, GPL only applies to source code, not any data that your app stores. I might be wrong on that, though.

share|improve this answer
up vote 1 down vote

Open source requires the source code to be made public and available, not the game data. So you could easily put the data in another file and not publish that one. Add some crypto if you want to prevent casual reading of the file. I doubt a strong crypto is necessary for your application.

share|improve this answer
    
In what sense can you "not publish" the game data? The game has to be able to access that data so anyone who has a copy of the game has a copy of the data. That's pretty much exactly what publishing is: making public. –  David Richerby 14 hours ago
1  
@DavidRicherby Depends on what you want to publish and to waht end. That game or your engine that could be used to create many similar games? Allow people to manipulate your game, inspect the code for security holes ore just re-use components? If your interface is as simple as "CSV with q&a + program = game" I think it's conceivable to publish only the program, not the CSV. –  Raphael♦ 13 hours ago
1  
@Raphael But distributing a game that consists of an executable and a plain text data file doesn't achieve the goal of making the answers secret. If you want to propose an encrypted version of the datafile, that's fine, as long as everyone understands that this is just security by obscurity (the key is in the source). But then we get into the question of whether the plaintext of the datafile constitutes source code in the sense of the GPL and, at that point, the question becomes a matter of interpretation of the GPL, rather than computer science. –  David Richerby 12 hours ago
    
@DavidRicherby: Agreed. Still, although IANAL, I very much doubt that a data file consisting of riddles and their answers would be considered such an essential and irreplaceable part of the program that it could not be licensed separately -- especially if you included an unencrypted sample data file in the source distribution, along with instructions for modifying and encrypting it if necessary, to make it clear that anyone with the source code can indeed create their own customized data files and use them with the program. –  Ilmari Karonen 10 hours ago

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.