Protecting twitter keys on Android

Question

When adding twitter authentication to my android app, going to Twitter dev, I was flabbergasted at finding that I have to initialize Twitter's Fabric like this:

import io.fabric.sdk.android.Fabric;
import com.twitter.sdk.android.Twitter;
import com.twitter.sdk.android.core.TwitterAuthConfig;
...

@Override
public void onCreate() {
    super.onCreate();

    TwitterAuthConfig authConfig = 
                new TwitterAuthConfig("consumerKey",
                                     "consumerSecret");
    Fabric.with(this, new Twitter(authConfig));
}

They are officialy recommending that I put both API Key and API Secret in my app as plaintext. Even in this official sample, the keys are stored in BuildConfig.

I am using Proguard but even then, I cannot guarantee that a determined hacker wouldn't be able to exploit my API Secret. Do established apps like Quora also expose these keys?

Can somebody post an example for overcoming this vulnerability, or give a convincing argument as to why Twitter is doing this?

In contrast, Google and Facebook only required me to add an AppID, and I had to hash my signing certificates and link the hashes to respective apps. This is levels of magnitude more secure than above.

Answer 1

Proguard will not obfuscate string literals. Instead you could store the secret as an encrypted string (maybe using AES) and decrypt when required. Alternatively, commercial programs such as Stringer or Dexguard provide string obfuscation.