1

I want to obfuscate all the webpages of my website. I Googled through some free tools like HTML and Javascript obfuscation but don't know how effective they are.

First of all, does it makes sense to obfuscate a webpage that could comprise of variety of codes like Javascript, PHP etc.

Secondly, how effective is this method?

14
  • 3
    Could you clarify and describe why you need such protection?
    – user2567
    Dec 26 '10 at 19:30
  • 2
    RPK: the technique is obfuscating a javascript file that contains the function that will generate the HTML for the paypal buttons. You call that function in your clear HTML.
    – user2567
    Dec 26 '10 at 20:13
  • 9
    At some point, real HTML needs to be sent to the browser, and the user will be able to inspect it dynamically using a tool such as Firebug. Dec 26 '10 at 20:26
  • 2
    Pierre 303 is right, obfuscating JavaScript might be slightly useful but obfuscating HTML or PHP is not. Obfuscation is also not a substitute for real security measures; it will only slightly delay a hacker. Dec 26 '10 at 21:03
  • 7
    Even if you obfuscate the Javascript, you can just use Firebug which will pretty-print the generated HTML. Even if you obfuscate the HTML, Firebug will still do a pretty good job of pretty-printing it, making the whole thing largely useless. PayPal understand this, and the code they give you is given with the understanding that it'll be in plain text on your site. In short: don't worry. Dec 27 '10 at 0:03
5

The best security against information being wrongfully used is to avoid sending the information over a public communications network.
If that is not an option, you have to consider who and what you are trying to protect against.

If you want to be safe from third-parties snooping the traffic between your website and your customers, then don't bother with obfuscating the webpages, but use a secure connection instead.

If you don't want your users to access some information that is needed by the browser for displaying the page or generating the next request, then encryption won't help you (the browser needs to be able to decrypt the information anyway) and obfuscation might at best slow someone down but it won't stop them obtaining the information.

For really sensitive information, you could store it locally on the server and only give out a (one time) unique ID for accessing the information on the next request.


As a sidenote, using obfuscation might make people more interested in knowing what you are trying to hide.

4

Obfuscating to attempt to hide PayPal button codes is not time well spent. You will not get a return on the time you spend on this so it is not worth the effort. Like others point out it can all be reversed so you will not be limiting those interested in finding out what goes on in your pages.

2
  • Than how to encrypt the content. Any way out?
    – RPK
    Dec 27 '10 at 6:29
  • 1
    If you want to hide, don't use open standards. Dec 27 '10 at 8:32
1

There is a way to make a text illegible for search engines and web crawlers while maintaining it readable for humans:

  1. You encode your text using some simple substitution cipher, such as ROT13 or Atbash.
  2. You apply to that text an special font (whose symbols have been unordered) that makes readable the encoded text, by reversing the substitution previously made.

I created an project at Github, called TuringFonts, that provides some resources and examples for implement this hack.

1
  • 1
    But that probably won't work for blind people, who are using some speaking software to browse the web. Apr 16 '15 at 11:31
1

does it makes sense to obfuscate a webpage that could comprise of variety of codes

It depends on what you want to achieve. If you want to remove the semantic (human readable meaning of object names and class names) by minifying the code, then I would say "Yes, it makes sense".

  • Because this effectively makes your files smaller, which makes your website load faster, and gets you some obfuscation that you are after as well

Secondly, how effective is this method?

It depends on which software tool you are using to do the obfuscation work for you.

I recommend Zeroify.com for html, css, and javascript obfuscation.

0

It isn't generally worthwhile to attempt this.

You want to hide the the PayPal button codes, but these are generated in a formulaic way by PayPal. Anyone who wants to learn about PayPal Button Codes can do that using resources already available on the web. It doesn't matter whether you obfuscate the code on your web page.

PayPal say:

All buttons created using [the Create a PayPal payment button page] are secure by default, so there is no further security action required.

so presumably some of the network security experts at PayPal have already had a chance to apply any obfuscation system they feel is necessary to the button code.

You don't need to obfuscate PHP code because you can generally keep that code secret if you want to, as many companies do.

In general when programming anything it is good practice to separate out any secret information from code to apply non-secret algorithms to that information, and store them separately. As Wikipedia says,

In cryptography, Kerckhoffs' principle [says that] a cryptosystem should be secure even if everything about the system, except the key, is public knowledge.

Not the answer you're looking for? Browse other questions tagged or ask your own question.