Thousands of secret keys found in Android apps

Re:Thousands of secret keys found in Android apps by girvo on Wednesday June 18, 2014 @11:53PM (#7914378)

What if you app doesn't have a backend? That's an honest question, I've been trying to come up with some way of using authe/autho keys on a fully client-side app (be it a mobile or desktop one) that is still secure; I can't think of a way to, as to communicate it requires the keys to be in memory, thus, vulnerable.

I dunno. I've wondered about all this myself quite a lot, perhaps its a non-issue?

[ Parent | on HN ]

Re:Thousands of secret keys found in Android apps by matlecu on Thursday June 19, 2014 @12:02AM (#7914418)

Yes I don't know of any good solution for client side only applications. And it's a real issue I think. For instance if I have your key, it may be possible for me to access data, post on behalf, etc... of people who signed in with the service on your application

[ Parent | on HN ]

Re:Thousands of secret keys found in Android apps by AUmrysh on Thursday June 19, 2014 @12:11AM (#7914450)

I think your only choice for doing this securely is to hide the keys behind your own server.

[ Parent | on HN ]