How secure is the "if" statement?

Question

Regardless of the language I'm always puzzled by the concept of security through an if. All the code I write relies on success of that one line with if statement:

user = getUserName();
password = getPassword();

if (match(user, password)) {
    print secret information;
}

Since it's only one line I feel like sabotage can be relatively simple. Am I overlooking things, or is a single if really the best way to do this?

Answer 1

You are right, an if like this is easily hacked. If one reverse engineers this application, you can easily modify a few instructions to skip the if.

There are various options, like obfuscating the executable or adding more complex checks and in add them in various places in your application. But whatever you do, your application can always be hacked.

Best thing is not to worry about it. By the time your application is so good and great and widely used that people are actually willing to put effort in cracking it, you will probably make enough money to protect it better. Until then, it's a waste of time to even think about it.

Answer 2

In the specific case you are showing, if you were really worried about unauthorized people seeing the secret information output by "print secret information;" you would encrypt the "secret information" with the supplied password. This would ensure that only the person who was able to provide the proper password would be able to see the secret information.