Minifying usually doesn't touch string literals. If you have a function like connectToSite, and tell it to connect to "https://mysite.com/", then minification will rename connectToSite to just the letter "a", but the site URL stays the same and will be easy to search for in the code. If you want to connect to www.evil.com and make it not clear, you'd have to do stuff that results in longer code, like split it up into individual characters, add number values to them to get different characters, and string cat a bunch of them together to get the final URL string.

To me, minifaction will rename reallyClearFunctionName("string param") to a("string param"). While obfuscation would also encrypt the "string param" and then decrypt it at runtime. Minification's main purpose is to reduce the size, obfuscation will go one step futher and make it difficult to understand what is going on. Side note, it can be obfuscated but "maxified" (if that is a thing).

Side note: the joke goes that Perl is a write only language as it is difficult to read it and understand it. Some twisted souls decided to create the obfuscated perl content: https://en.wikipedia.org/wiki/Obfuscated_Perl_Contest

For a list of some of the winners: https://www.foo.be/docs/tpj/issues/vol4_3/tpj0403-0017.html

Advanced minification might do more optimizations than just shortening names though. In the extreme case you might have a sort of optimizing compiler that performs the equivalent of `-Os` which can make code quite unreadable.

But yes, even that shouldn't be encrypting strings.

Sure. You could also imagine a better minifier compressing string constants to save even more size.

from what i undersand, minification just involves removing line breaks and tabs and can be un-minified fairly easily with tools such as https://beautifier.io/. obfuscation involves techniques such as changing function/variable names from human-readable to human-unreadable, changing certain strings to concated variations of themselves, base64 encoded, or other similar transformations.

e.g. original code:

function NewObject()

{

var mainApiUrl="https://google.com";

}

minified code:

function NewObject(){var mainApiUrl="https://google.com";}

obfuscated code:

var _0x8275=["\x68\x74\x74\x70\x73\x3A\x2F\x2F\x67\x6F\x6F\x67\x6C\x65\x2E\x63\x6F\x6D"];function ahyt56(){var _0xb40bx2=_0x8275[0]}

Minifiers also reduce variable and function names to a minimal size, one character wherever possible. They do other things too... such as remove semicolons that are not needed (not in general possible, especially if you've gotten rid of line breaks, but can be done in the last statement of a block or function, for example.) The idea is to optimize for bits sent over the wire.

function a(){var b="https://google.com"}

That's why it's difficult to read minified code even if it's not obfuscated to the further extent that you sometimes see in attack payloads.

They usually also reduce variable and function names to single letters, or as short a unique sequence as possible. E.g.,

  function a(){var b="https://google.com";}

You can run it through a beautifier and get it readable again.

I don't think that's true. I don't think any tool can automatically recreate meaningful symbol names once they have been destroyed (absent things like debuginfo, which is irrelevant in the javascript context).