# SecureToken and SWF decompilation

**URL:** <https://community.wowza.com/t/securetoken-and-swf-decompilation/37581>\
**Category:** Wowza Streaming Engine\
**Created:** [May 24, 2013, 6:53am UTC](https://community.wowza.com/t/securetoken-and-swf-decompilation/37581 "2013-05-24T06:53:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nicolas\_Guyds](https://avatars.discourse-cdn.com/v4/letter/n/9d8465/32.png) [@Nicolas\_Guyds](https://community.wowza.com/u/Nicolas_Guyds)\
**Post date:** [May 24, 2013, 6:53am UTC](https://community.wowza.com/t/securetoken-and-swf-decompilation/37581/1 "2013-05-24T06:53:58Z")

</div>

Hello

We have implemented the SecureToken parameter, but its very easy for people download the SWF and then get the token from there. Then, they surface our site using RTMPDUMP. We have tried to obfuscate with a 400usd license from SecureSWf with no luck, people still can hack the JWplayer somehow. Is there any other wowza security that we can implement, we have a free site, so no user/password are good for us. I feel wowza is really really unsecure so far.

Thanks

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [May 24, 2013, 2:57pm UTC](https://community.wowza.com/t/securetoken-and-swf-decompilation/37581/2 "2013-05-24T14:57:16Z")

</div>

Are you using rtmps or rtmpe? Take a look at the new Security Overview article:

[https://www.wowza.com/docs/media-security-overview](https://www.wowza.com/docs/media-security-overview)

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [May 24, 2013, 3:13pm UTC](https://community.wowza.com/t/securetoken-and-swf-decompilation/37581/3 "2013-05-24T15:13:38Z")

</div>

The Security Overview is a thorough look at the options, except a custom security layer. For example, expiring links as in this Wowza customer’s post:

[http://community.wowza.com/t/-/33555](http://community.wowza.com/t/-/33555)

We don’t have any Wowza examples like that because the point is to make something up. Of course your options are more limited without user authentication.

Richard

---

<div class="post-metadata">

**Author:** ![Nicolas\_Guyds](https://avatars.discourse-cdn.com/v4/letter/n/9d8465/32.png) [@Nicolas\_Guyds](https://community.wowza.com/u/Nicolas_Guyds)\
**Post date:** [May 24, 2013, 7:02am UTC](https://community.wowza.com/t/securetoken-and-swf-decompilation/37581/4 "2013-05-24T07:02:13Z")

</div>

I’m using RTMPE. I was thinking they might be getting the token using wireshark or other method once the code left the SWF.