Hidden Variables – Serial Number Logging

[yuvnith]

Question

Hidden Variables – Serial Number Logging

In WiX v3, Hidden Variables could be used to prevent sensitive values such as serial numbers from appearing in the engine log. This functionality appears to have changed in WiX v4, where hidden variables are no longer encrypted and a variable can no longer be both Hidden and Persisted.

Requirement:
We need to prevent serial numbers from being exposed in the bootstrapper engine log.

Question:

• Why was the previous WiX v3 behavior for Hidden Variables changed/removed in >= WiX v4?
• Is there a recommended latest WiX mechanism for keeping sensitive values such as serial numbers out of the engine log?
• If this functionality is no longer provided by the engine, can we replicate the WiX v3 behavior in our custom bootstrapper application (BA)—for example, by handlingthe value ourselves and ensuring it is never visible in the engine log?

Open Source Maintenance Fee

• I (or an organization I'm a member of) pay the Open Source Maintenance Fee by sponsoring the wixtoolset project because I support the maintainers.

[robmen]

WiX v3 did not encrypt hidden variables. They were in plain text in the resume file. I'm pretty sure that is why Persist + Hidden was no longer supported in WiX v4, because people thought there was some level of protection. So, you can mark the Variable Hidden to prevent it from being logged, and then your BA will need to take care of the encryption.