1

Let's say you have an Android or iOS app, how can you store a web API key (a string) in your app securely, making it impossible or harder to reverse engineer.

Some solutions I have thought about :

  • Storing, along with the web API key a 1000 other fake keys with the same length so that the when trying to reverse your app it will be hard to determine the right one.

I am sure there are better solutions to do this. Thank you !

Improve this question
4
  • Remember that your app will have to act on this string (send it through https if I understand correctly). So if it's encrypted it will have to be decrypted. If you have 1000 fake strings, only this one will be sent. This is the weakest link of your app. Attacker can just see what you have prepared for sending.
    – user31389
    May 9, 2015 at 21:53
  • user31389 That's right, the string will be sent through https. So it is possible for the attacker to see what I am sending? How does Parse work so that it assures a secure connection between you and the cloud?
    – Catalin Craciun
    May 10, 2015 at 6:02
  • Will have look on the 'Protect data stored in binary' question. Thank you
    – Catalin Craciun
    May 10, 2015 at 6:02
  • you can implement own pseudo random generator and send the actual seed for the offset shuffle table (from the linked duplicate Q/A) along with your shuffled string ... also you should send more then just one key ... add more data to packet to make harder to determine which data is what does not need to be 100 keys I think 2-8 will be enough. Also if the packet size is variable over time then it is very hard to hack/decode it ...
    – Spektre
    May 10, 2015 at 7:32

0

Reset to default

Browse other questions tagged or ask your own question.