TrueUpdateUser
02-22-2008, 10:22 AM
Is it possible to replace the blowfish symetric key encryption by an asymetric one? We are afraid that there is a serious security flaw with a symetric key since all updated users share the same key. We realize that the key is encoded in the client data, but nevertheless, it is not impossible to reverse engineer the trueupdate code to retain the key, create your own malicious script (=virus) and send it to the update sites with some spoofing tricks.
Thanks :)
Thanks :)