title: Techniques for obscuring sensitive strings in C++
body: <p>I need to store sensitive information (a symmetric encryption key that I want to keep private) in my C++ application. The simple approach is to do this:</p>
  <pre><code>std::string myKey = &quot;mysupersupersecretpasswordthatyouwillneverguess&quot;;
  </code></pre>
  <p>However, running the application through the <code>strings</code> process (or any other that extracts strings from a binary app) will reveal the above string.</p>
  <p>What techniques should be used to obscure such sensitive data?</p>
  <p><strong>Edit:</strong></p>
  <p>OK, so pretty much all of you have said <em>&quot;your executable can be reverse engineered&quot;</em> - of course! This is a pet peeve of mine, so I'm going to rant a bit here:</p>
  <p>Why is it that 99% (OK, so perhaps I exaggerate a little) of all security-related questions on this site are answered with a  torrent of &quot;there is no possible way to create a perfectly secure program&quot; - that is not a helpful answer! Security is a sliding scale between perfect usability and no security at one end, and perfect security but no usability at the other.</p>
  <p>The point is that you pick your position on that sliding scale depending on what you're trying to do and the environment in which your software will run. <em>I'm not writing an app for a military installation, I'm writing an app for a home PC</em>. I need to encrypt data across an untrusted network with a pre-known encryption key. In these cases, &quot;security through obscurity&quot; is probably good enough! Sure, someone with enough time, energy and skill could reverse-engineer the binary and find the password, but guess what? I don't care:</p>
  <p>The time it takes me to implement a top-notch secure system is more expensive than the loss of sales due to the cracked versions (not that I'm actually selling this, but you get my point). This blue-sky &quot;lets do it the absolute best way possible&quot; trend in programming amongst new programmers is foolish to say the least.</p>
  <p>Thank you for taking the time to answer this question - they were most helpful. Unfortunately I can only accept one answer, but I've up-voted all the useful answers.</p>