I want to create a file in a python3 program, in which I want to store some information that I don't want users to see or manipulate. However, in execution time I need to read and modify its content, being sure that users cannot modify the content of the file. How can I achive this?
2 Answers
All information stored on end-user devices can eventually be manipulated.
One option is storing the data you don't want users to manipulate on a web-server and retrieve/update it when needed. The downside of this approach is that your code cannot work offline.
4 Comments
Daniel Contreras
Do you have a reference where I can find how to do this? Is possible to save information locally and send it when conection is available?
Pedro Lobito
"All information stored on end-user devices can eventually be manipulated", so no, I don't have any suggestion to do so.
Daniel Contreras
I mean, where can I find how do I send it to a web-server and retrieve when needed
Pedro Lobito
In this example I used Fernet and a key created with a password "hardcode". You can encrypt the file and decrypt the information inside only when they are necessary. If you have to modify the information, you can just call again the encrypt function.
from cryptography.fernet import Fernet import base64, hashlib def encrypt(filename, key): f = Fernet(key) with open(filename, "rb") as file: # read the encrypted data file_data = file.read() # encrypt data encrypted_data = f.encrypt(file_data) # write the encrypted file with open(filename, "wb") as file: file.write(encrypted_data) def decrypt(filename, key): f = Fernet(key) with open(filename, "rb") as file: # read the encrypted data encrypted_data = file.read() # decrypt data decrypted_data = f.decrypt(encrypted_data) print(decrypted_data) my_password = 'mypassword'.encode() key = hashlib.md5(my_password).hexdigest() key_64 = base64.urlsafe_b64encode(key.encode("utf-8")) # file name file = "test.txt" # encrypt it encrypt(file, key_64) with open("test.txt", "rb") as f: print(f.read()) decrypt(file, key_64) 
5 Comments
Pedro Lobito
Do you plan to hardcode the password or key? If that's the case, this is definitely not the way to go.
Umb
@PedroLobito that was just an example about how Fernet works. Of course it is possible to create a better key and not use an hardcoded password.
Umb
@PedroLobito however, there are cases where you can use a "web-server and retrieve/update it when needed" like in ChatoPaka's answer, and cases where you cannot use that solution. In my case, customer uses my software in very large productions, where there are lots of operators that can touch my configurations files. It is impossible to say "don't touch those files", because 100% someone will touch them. In those cases I suppose that a "stupid" encrypt protection could be enough to stop this problem.
totalMongot
Not sure to understand: in this example the software don"t need to hardcode the password "my_password", it is the operator that needs to store it? Or I don't understand?
totalMongot
When you used: "key = hashlib.md5(encoded_Pwd).hexdigest()" is it the creation of a public key from the private key "encoded_Pw"?