Menu
I need to store some sensitive information in an Android application. If I put it in a resource file, it appears that it is trivial for another app to be able to browse and read that file simply by using PackageManager.getResourcesForApplication().
Where is the correct place to put information like this that we don't want people to be able to easily snoop?
Should it be in a compiled java file? Or are classfiles also easily readable? Also, if they're in java files, is it possible to reference them from XML files that need them (eg. for the google maps api key)?
347
Don't store your API key directly in your code. Instead, store your API key and secret directly in your environment variables. Environment variables are dynamic objects whose values are set outside of the application. This will let you access them easily (by using the os.
In general sensitive data stored locally on the device should always be at least encrypted, and any keys used for encryption methods should be securely stored within the Android Keystore. These files should also be stored within the application sandbox.
Instead of embedding your API keys in your applications, store them in environment variables or in files outside of your application's source tree.
Your APK will be retrieved from the device and torn apart anyway. (After all, some devices are rooted.) Whatever you hardcode there, no matter where, will be found and extracted. Of course, if the potential gain substantiates the effort. Otherwise, security by obscurity, such as obfuscation, may be the way to go.
Handling real secrets should be based on some sort of input, notably passwords.
Happily, API keys, if used as they are supposed to, are not necessarily a real secret.
98
Google has some good recommendations on this under billing. To summarize: use remote server, obfuscate and use secure random nonces. Nothing is safe in your apk as it always can be reverse engineered and obfuscation only works against simple attacks.
27
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
