This message was deleted.

# android

[Slackbot]

This message was deleted.

[rezenebe]

this is cool, but storing in properties can't be that much of a vulnerability right?

[rezenebe]

i'd like to think that most android apps are storing apikeys in that way, they can't all be at risk. Basic obfuscation shoulddo the trick

[msink]

Hm, why? IMHO reverse engineering of small .so file is much easier than big .jar.

[Foso]

A few days ago i wrote a small annotation processor that will generated the C file by annotating the external functions https://github.com/Foso/C-Crit_Generator

[dariuszbacinski]

Saying that storing api key in native code is more secure is over statement. Level of security is exactly the same.

[dariuszbacinski]

Even worse it gives false sense of security.

[rezenebe]

why is it a false sense of security @dariuszbacinski

[dariuszbacinski]

Because you may think that your stuff is more secure just because it is stored in native part but it is not. This may encourage you to put things there which should never be there, like admin keys.

[dariuszbacinski]

To me there should be a clear disclaimer that it does not make your keys more secure.

[dariuszbacinski]

Like Mike said, for some of attacker it may be easier to extract key from native binary then from android resources.