0

I have a set of rest services exposed on a public host. There are mobile apps (android, iOS and windows) that will be consuming these services. For authentication purpose, I am using a secret key that has been shared with these apps and when they hit the services, the sent key is first matched with the actual key and services are served only when the key matches. My question is that is it possible for a hacker to reverse engineer the mobile apps and obtain that secret key (so that he can misuse the web services)? If yes, then how easy is it to do that and what is the solution to this problem?

2 Answers 2

2

The thing is how you are saving the secret key in your app .Now there can be many things

  1. Encrypt you key
  2. Use progaurd
  3. Use private but not default shared-preferences(If saving the key in preferences)
  4. Use HTTPS instead of HTTP

These are some ways with which you can secure your key and make it difficult to reverse the process, but again nothing is completely secure but my doing these steps you can make the much difference .

1
  • 1. Begs the question of securing the encryption key. 2. progaurd is an obfuscator and does not provide security. 3. Is vague but still saves the key insecurely in a file. 4. Yes, use https for secure communications to the server.
    – zaph
    Oct 20, 2014 at 11:57
0

For iOS use the Keychain to securely save the key. There is a Keychain in Android but it works somewhat differently.

Use https to secure the commutations of the key to the server.

Consider an authentication scheme such as CHAP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.