A modern programming language that makes developers happier.

kotlinlang

I have one question. Some developers say if we put API endpoints or important logic in C++/NDK, then it becomes secure and hackers can’t easily find it.
Is that true? Does NDK really protect it, or does it just make reverse engineering a little harder? How does it work?

It's just a _little_ bit harder.

The rule is: if the code ends up on the user's device, a user with sufficient time can know everything it does.

Ghidra and IDA are both very good at decompiling C++ code.

No. It's extremely easy to decode for anyone who spends enough time. Btw I'm preparing a talk on this: <https://docs.google.com/presentation/d/1JuF_ym2vVqsZALAaVTFcD_qEmExgEIZII28OmWcaIjc/edit?usp=drivesdk|https://docs.google.com/presentation/d/1JuF_ym2vVqsZALAaVTFcD_qEmExgEIZII28OmWcaIjc/edit?usp=drivesdk>

I just made the slides, never got to actually speak on it.

No, this is not true, NDK is easily reversed using proper tools like IDA or Ghidra. Though you can make it harder by using tools like OLLVM + Runtime detections  (apk signature check, string obfuscation , dangerous apps, dangerous binaries and etc)

API endpoints specifically are easily found by using Charles proxy or Burp Suite

Not only is this security theatre, it also causes poor performance due to having to do the NDK/ART switching dance.

Yes, the proper way is to prevent having unauthenticated APIs, and depend on certificate pinning along with secure keystore to store credentials. API Keys should never be kept client side.

<@U0A8H1SF1NV> Indeed, bind access to the APIs to the specific authenticated user (you can't ensure the client ID - although it is still good to have a clientId). Best practice for clientIds would still require a per-instance clientId/secret, but of course those are assigned dynamically so cannot be relied upon for security purposes (or really charging for traffic).