在python模块中封装/隐藏秘密

Question

Currently I'm running a microservice that does some transformation involving a secret with a string it receives and returns the new string. So the data is moved across the network to the function.

However, to improve the performance, its preferable if the function comes to the data. It would be great to have a local python module (we are set to python here) that performs the transformation and only receives the secret at initialisation.

So now the question: How can I store (temporarily) the secret in a way, that the user of the module is not able to read it? Its not a strong secret, so it does not need fancy crypto here. But it should prevent the user from reading it without any effort, as the python "private" class variable allows.

Answer 1

Since the user can presumably just edit the module to intercept the secret as it's being received from the network, and see how it's accessed, there's not much to gain security-wise from obfuscating how it's stored.

Either way, if you really do want to do this, I'd suggest sneaking it into somewhere else than your module; for instance, you could slip it into the namespace of a builtin module like sys ... But again, the moment someone reads your module's code (either from the .py or by decompiling), they will see what's happening.