Securing an android application

Question

I have 'secured' the communication between my android application and a tls server providing a financial transaction service, currently in development.

The security credentials are stored in a BKS keystore included in the Android apk. The password to the keystore is visible in plain text in the application source:

keyStore.load(is, "passwd".toCharArray());

I am concerned that if someone was to reverse engineer the app, they would be able to impersonate another user and compromise the security of the service.

I was wondering whether there is a fault in my implementation, if anyone else has this concern, and what the best method of securing against this possibility is.

Answer 1

Whenever you store security data on the client it can be compromised by reverse engineering. You may try to obscure it in the code but determined hacker will figure it anyway. So the only way to make it more secure is not to have the password openly in the code. May be you can just ask user for some pin code at the start of the application and use it to decrypt the password?