How to hide a secret key on a user's machine(NOT your own server)?

user_15370419 0
Viewed 218

This question has been asked HUNDREDs of times, and there are HUNDREDs of articles on how to do this, but ALL of them only speak of environment variables, which won't work in my scenario, since the code will be run on the user's device and not my server. So the user can just open the .env file or check the environment variables I add to his system and get my secret key. I want my key to be fully hidden, even on the user's own device. HOW to do this? Please help me! My code is something like this:

client = Client()
client.login('username', '<hidden password>')

How to hide the hidden password?

secret-key api-key information-hiding security python
1 Answers

It's technically impossible to hide anything from a sufficiently educated user on their own computer (malware being one notable exception). This problem needs to be solved on the server side. The only reason why you may want to hide the password from a user is that you don't want to allow certain operations to be executed using the client or any other means. If instead the user account is only restricted to the safe set of operations, it can't hurt if the user knows the password.

user_7708300
Related