how to secure my secret key in strings.xml file in Android

Question

I am placing my secretkey in strings.xml. I checked by reverse engineering with apktool and I got my strings.xml file as R$string.smali when I checked in that file to see whether key is visible or not then i found my key string as

# static fields    
.field public static final secretkey:I = 0x7f0a0035

Is there any possibility of fetching the key from this id or any other process is there to fetch my secretkey from strings.xml file.

You should expect that there is somebody else who is at least as clever as you. So if you are going to distribute this application, anybody could do the same and discover your secret key in the process. — likeitlikeit
– likeitlikeit, Commented May 7, 2013 at 15:01
So there's no point in encryption etc. at all, because somebodys gonna be more clever anyways? Come on ... — fweigl
– fweigl, Commented May 7, 2013 at 15:06
using tools like apktool you can get all resource files from apk and I'm pretty sure that this include string.xml file too in clear way. — hardartcore
– hardartcore, Commented May 7, 2013 at 15:08
As Igor say, never store a secret key in strings.xml or in the code. You can generate on the phone or get it from a server at the first launch of the app. — shemsu
– shemsu, Commented May 7, 2013 at 15:11
thxs guys for replies, but i m asking you straight forward question whether key can be fetch from that id. — Vinod Kumar
– Vinod Kumar, Commented May 7, 2013 at 15:32

Igor S. · Accepted Answer · 2013-05-07 15:08:00Z

1

You should not store secret key in strings.xml

More secure options are: SharedPreferences or internal storage with mode write localy. In most cases I suggest generate key on the phone. So every phone will have thir uniq key.

But remember there are no absolute security, rooted phone user can do anything with his phone.

answered May 7, 2013 at 15:08

Igor S.

3,3501 gold badge27 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Vinod Kumar Over a year ago

as my algorithm was developed with a process of encrypting by combining two keys and a message which should be same exactly at server side. its a difficult process to decode, but the problem is to store one of the key while connecting to server in the application itself. make some clear suggestions.

siddharthsn · Accepted Answer · 2013-05-07 15:10:19Z

0

Try Constructing the key at runtime. Bit manipulation / shuffling the key can be one way of doing this.
Have a customized encryption and decrypt the key at runtime.
If you can afford, you can get the key from a server.

answered May 7, 2013 at 15:10

siddharthsn

1,7091 gold badge22 silver badges32 bronze badges

Collectives™ on Stack Overflow

how to secure my secret key in strings.xml file in Android

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related