Digital Workshop

Hi

Continuing to look at ways to make Flex pubs more secure, I was hoping that Forum colleagues, experienced in Flash content development, would weigh in.

I've been on a steep learning curve about Flash and recently found out that Flash content is not very secure. Almost anyone with a SWF decompiler (relatively inexpensive programs) can open up SWF files and take or modify the code, then recompile the result. Script-in a password or expiry date, and apparently the decompilers can quickly change or eliminate these.

There are 3 programs that can encrypt SWF files (more, if you count programs that create and encrypt Flash executables/projectors: http://www.swfkit.com is an excellent one).

Some SWF encrytpion software is less functional than advertised. The leading SWF encryption tool, that does work, is SWF Encrypt: http://www.amayeta.com/.

On developer forums, the cynical take is that these work until the hackers devise ways around them. Deterence is the operating principle since 100% security is impossible.

Before investing in a SWF encryption tool, I would appreciate getting some feedback.

Please weigh in and share your opinions.

Kind Regards,

My first question would be what is it in your Flex publication that is so special you want to protect it? This is not a flippant question, just an honest question. If you can identify what it is, perhaps you can create a workaround for it. So let's say a video is something you want to protect. You could always use some method so that the video would be hard to access and would be called externally to the main Flash file.

I think you have to assume that pretty much anything you put out on the web is inheritantly insecure and operate from there. Perhaps you could have a log-in to get to the Flex publication and control it that way, or as you said, make it an executable and give it protection via encryption that way.

Hi

Thanks for your reply.

My needs may be quite different than many others. For me, it's not necessarily the content value that I'm trying to protect, but rather the quality of the work. Let me explain:

I am asked for samples of Flash/Flex learning modules that I've created, which, while fairly complete, are not yet ready for "prime time." My style is to continually revise and change these, getting them up to a higher level of quality, before final release. But, once a sample is released, it's beyond recall, even though I may make substantial changes or corrections to it a few days/weeks later. Can't get them back, and others, in spite of requests to the contrary, can circulate them. So, adding a date certain-expiry is helpful. (Passwords are less useful as they can be passed around as well. Marking them "Beta" can be eliminated by a decompiler.)

SWF decompilers can easily open up the script, including expiry date, and eliminate it.

The reason I need to encrypt the SWF and not a Flash executable/ projector is that these learning materials are developed for mobile devices running Win Mobile 5.0. The executables, which can be encrypted, only run on desktop Windows, not the Win OS for mobile. So, the only solution is to encrypt the underlying SWF.

If only an encryption option could be added to Flex, even only for an expiry date. The SWF encryption programs rely heavily on "obfuscation." If only Flex could "obfuscate" such an expiry date. (Wishlist?)

I hope this helps to clarify what I'm looking to do.

Kind Regards,

I would say then that the SWF Encrypt™ 3.0 is probably the way to go. The only other thing I can think of is to set something up on each page so that it "pings" your server somewhere and if it doesn't get a response, exits the SWF program.

Hi

Thanks for your reply.

There's one more new program for me to check out:

secureSWF at http://www.kindisoft.com/index.aspx

They mention a soon-to-be-released professional version.

Kind Regards,

I use Flash SWF's a lot and decompilers are a fact of life.
I've experimented with many obfuscators, including the two mentioned in this thread.
I agree with bwpatric here, IMHO Amayeta swfEncrypt is by far the best one on the market for making the script irreversable by the usual decompilers.
The three best decompilers to check file security against are Actionscript Viewer (ASV), Sothink SWF Decompiler, and Imperator Fla.
These are in quite wide use by most Flash devs.


Paul

Hi Paul

Thanks for your thoughts on this.

I'll probably go with SwfEncrypt.

One other issue I'm trying to clarify: what Flash (ActionScript) level is Flex written in? As I learn more about Flash and the Flash versions supported in the mobile Flash player 7 and the FlashLite (Smartphone) player, I wondered what Flex is written in.

Any thoughts about this are appreciated.

Kind Regards,

When you are authoring in Opusscript, you are using something fairly close (more or less) to Actionscript 1.0 (Flash 5 level).
If I need to, I refer to Actionscript books written for Flash 5 or Flash MX if I am writing Opusscript.
If you run a decompiler over a published Flex SWF, you get a mix of proprietary code written by DW, and actionscript 1.0.
Only DW is qualified to comment further on this.

Paul

Hi Paul

Thanks for your reply. So far, anything I've created in Flex has successfully viewed in runtime. I hope that DW, as they update Opus and issue a new version, continue to update and add functionality for Flex.

Kind Regards,

Hi Paul

I thought some more about your reference to using ActionScript and wondered how this is accomplished.

Is it that you use Opus Flex's script editor and place ActionScript instead of OpusScript in it? I'm just guessing, since I wonder if that would even work.

Or, do you decompile the Flex SWF, edit it by adding ActionScript, then recompile/publish it?

Liking Flash as a medium, I'm wondering how to extend Flex's features and functionality by starting in Flex and then building on it.

Any suggestions would be appreciated.

Kind Regards,

My explanation was somewhat unclear.
What I mean is Actionscript 1.0 and Opusscript are both based on the same specifications (ECMA-262 book1). -- they are NOT generally interchangeable.
I use Actionscript as a GUIDE when writing Opusscript.
There are many differences, especially as Flash is frame based and often makes reference to frames in script.
Opusscript won't work with references to Movie Clips, something that Flash uses a lot.
There are many other differences.
Actionscript and Opusscript are entirely different when anything is drawn to the screen, the few scripts that are interchangeable have no reference to anything that is visible.
Be careful not to paint yourself into a corner with Flex.
Flash is a more flexible product designed primarily for SWF production.
Opus is much better for CD/DVD authoring.
I think Flex is a good product, but it only delivers a subset of Opus capabilities.

cheers
Paul

Thanks Paul for your informative reply.

In addition to Flex, I have SwishMax and have reviewed a trial version of Flash 8 last week. SwishMax and Flash 8 are, for me, not very easy authoring programs.

I am developing learning content these days for mobile devices with small screens. The Flash mobile players for handhelds and Smartphones I believe only support lower level ActionScript, for now. However, the next permutation of Flash player coupled with Acrobat reader, Adobe Apollo, when finally released next year for mobile platforms (?) will likely support higher levels of ActionScript.

I greatly prefer the GUI, actions, familiarity with features and ease of use in Flex. However, as you can tell from these questions, I am beginning to foresee the need for more Flash functionality. My hope, since I really like working in Opus, is that the next version has enhanced Flex capability.

Unsure of the outcome, I'm always on the lookout for multimedia authoring capability that (1) publishes to Flash and (2) is scriptable. (The Adobe/Macromedia products like Director, that may do only some of this, are enormously expensive.)

Again, thank you for your suggestions.

Kind Regards,