Cancel Adobe if you are a creative under NDA with your clients

Re:Cancel Adobe if you are a creative under NDA with your cl... by Kerbonut on Friday June 07, 2024 @11:38AM (#40609688)

> he will be able to see my power consumption, see who called, listen to voice messages, and so on

So is your API key baked into the app? Implement a login screen or a field for the API key and then who cares if Google has a copy of your app, they can't access your data.

[ Parent | on HN ]

Re:Cancel Adobe if you are a creative under NDA with your cl... by qwertox on Friday June 07, 2024 @12:14PM (#40610036)

There is no API key. The URLs are not public, not guessable, and traffic runs over HTTPS. Any attempt at accessing a wrongly guessed URL bans the IP address. I have no intention to rewrite this stuff.

You need to have the app to get to know the URLs.

[ Parent | on HN ]

Re:Cancel Adobe if you are a creative under NDA with your cl... by jpc0 on Friday June 07, 2024 @12:54PM (#40610499)

Randomly generated url (even by a bad random generator like a human) is equivalent to an API key. Your exact same argument you made about the url can be made about a baked in API key.

Implement auth, do extremely basic auth if you have to using http basic auth over https and check against a hardcoded value on the server, it's not secure by any stretch of the imagination but is better than giving "api keys" to any intermediary that can do a string dump on your APK...

[ Parent | on HN ]