Ask YC: API in an Ajax Adobe AIR app?

AIR has an encrypted local store you can hide secret information in.

thanks - i know about this, but can you store information in it pre-installation?

> The problem is that the air installation package contains all the source and I don't want to give away my shared secret. Is there any way to do this?

You've got to give the secret out in some fashion or another - otherwise the application won't be able to decrypt the picture or whatever is it.. Even if you obfuscate it, it'll still be somewhere (in memory or whatever).

Maybe this requires a rethink of your security model? What are you trying to secure?

Install the app and then the first thing the app does at first run is make an api call to get the key and store it into the encrypted store. Pass the md5 hash of the swf as part of the call to get the key to make sure its your own swf thats making a call to the server.

you could have your application do some sort of authenticated request for it on a server maybe? Or better yet, proxy all of your api requests through your server?

I don't know, seems like a lot of runaround to me.