I'm writing an open-source node.js library that lets people control some hardware, mostly for use in home automation systems. The messages to and from the hardware are AES encrypted, but I was able to find the private key embedded in their Android app.
I know I can't distribute the key along with my app, but generally speaking, can I provide end users with instructions on how to get the key themselves?
I was thinking either being vague (e.g. download the APK, decompile it, find the key in there), or being a little more specific (e.g. download the APK, decompile it with XYZ, look in /src/com/example/lib/keys.java) or perhaps somewhere inbetween (e.g. download the APK, decompile it, do a string search for "private key =")
I understand that Stack Exchange is not a lawyer, but I'm not seeing much on Google to aid me in my research, and wondered if anyone here had some generic advice. I'm in Australia, but advice from anywhere would be helpful.