Beefing up Secirity and Encryption in Air Apps

Question

Hello,
We are working on an AIR app currently and concerned about
security when it comes to local data and content. We have come up
with a few ideas which may help.
1. Storing Data in the local encrypted datastore
This is a great feature, unfortunately, you need to get the
information into it in a secure way. Storing usernames and
password...urls etc in plain text in the AIR file is a bad idea.
Pulling the info down from the server and firing it in is better,
but this adds reliance on a server, which developers may or may not
have access to, and still may have security issues.
Would it not be possible to have a new option/panel added to
the Air settings window that allowed developers to add a list
variables/values that they wanted set in the local encrypted
datastore upon the initial install of the application. These
variables could be encrypted in the AIR package perhaps, using a
key/encryption routine known only by Adobe and removed from
existence as soon as they were added safely to the local enc
datastore. Perhaps a function could then be added to the API that
allowed these variables to be pulled back out and decrypted. I
realize the local datastore is encrypted, but what we are talking
about is getting the data into it in a more secure way that does
not necessarily rely on a server or having to store the keys in
plain text in the air package.
2. Encrypting the descriptor file and/or SWF content.
Although the swf format is easy to decompilable, if you
encrypted it, it's a much harder go. The end user really should
have no need to ever see this info, and developers could then
potentialy use things like the Application ID or publisher ID to
help secure other aspects of their app. Also, if its encrypted,
perhaps this is were extra variables could go. Once again, the
encryption routine/method used to pull this off could be
proprietary and known only to ADOBE. If developers could safely
store there own encryption keys in the local datastore, they could
even come up with there own routines, or use other encryption
standards that already exit to protect there content.
Just to wrap up, I really think AIR is great, but I think it
could be fantastic if ADOBE worked a little magic and chipped of
the security aspects in AIR a bit. I think this is one of the only
major stumbling blocks I can see for mass adoption for serious
industrial strength apps using AIR.
Where there's a will there is a way, and perhaps there are
others out there with innovative ideas that could contribute to
beefing up AIR security.

Answer 1

Here are some screen shots:
Any Help?