2

I'm writing an open-source node.js library that lets people control some hardware, mostly for use in home automation systems. The messages to and from the hardware are AES encrypted, but I was able to find the private key embedded in their Android app.

I know I can't distribute the key along with my app, but generally speaking, can I provide end users with instructions on how to get the key themselves?

I was thinking either being vague (e.g. download the APK, decompile it, find the key in there), or being a little more specific (e.g. download the APK, decompile it with XYZ, look in /src/com/example/lib/keys.java) or perhaps somewhere inbetween (e.g. download the APK, decompile it, do a string search for "private key =")

I understand that Stack Exchange is not a lawyer, but I'm not seeing much on Google to aid me in my research, and wondered if anyone here had some generic advice. I'm in Australia, but advice from anywhere would be helpful.

Improve this question
3
  • 5
    Please post your question to law.stackexchange.com instead, or better yet, talk with a lawyer directly.
    – Jason Geffner
    Commented Mar 21, 2016 at 13:17
  • @JasonGeffner I looked at law.stackexchange.com/help/on-topic but felt that my question didn't belong there. Then I saw the "law" tag here, which states that "This tag is for questions relating to legality and not about ethics. If using this tag, then please add details about your location such as state or country". Yes my question isn't directly about reverse engineering as per the help center, but it's a reverse-engineering based topic (I RE'd an app to get the private key), hence why I posted my question here.
    – Grayda
    Commented Mar 22, 2016 at 10:36
  • Thanks for pointing out the wording for the law tag. I've now updated it.
    – Jason Geffner
    Commented Mar 22, 2016 at 13:20

1 Answer 1

Reset to default
0

IIRC in Australia it is completely legal to reverse engineer code for "compatibility" purposes, with some caveats (e.g. source must not be available from the vendor and you must have legally purchased a copy you reverse).

You can describe the procedure in full, just don't include the actual key in your writeup :) You do need a lawyer's advice on how to better phrase your text.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.