Well, yes, you can encrypt in the flex client, but in order to decrypt on the 
server, you will need to share the *key*. If the decryption key is in the Flex 
client, then your same man-in-the-middle will be able to obtain your swf, 
decompile it can find the decryption key; even if you keep the decryption key 
in the server, a man-in-the-middle can create their own encrypted messages 
(which may cause you some problems) or have plenty of information to work on 
reverse engineer (crack) the encryption keys.

The value of SSL is that the 'working keys' are exchanged dynamically, inside a 
carefully constructed tunnel, and with the public-key certificate so you have 
assurance that your client is talking via a clear channel to your DNS-named 
server. (assuring that any man-in-the-middle cannot participate in the key 
exchange; and so cannot decode your transactions)

So: if you want *security* versus anything that smells like "convenience" or 
"slightly lower bandwidth" or "slightly less computation"; then Yes, you will 
want to build a complete SSL connection. If you really want the rest of your 
app to not use SSL, that *should* be possible by specifying  http: urls for 
those.  I'm not an expert on all the options in the flash/flex runtime or how 
to configure that, but I can state with complete confidence that there are no 
good/reliable "shortcuts" to security; use SSL/TLS.



Reply via email to