Having read the paper [1], the authors suggest the following as a solution to the API key conundrum:

   To avoid the need of storing secret tokens on a mobile device, Facebook
  leverages the presence of the official Facebook Android application on 
  Android devices. The Facebook SDK allows third-party applications to use 
  Android intents to proxy requests for user access tokens through Facebook's 
  Android application, where the user is already authenticated. To retrieve a 
  user's access token with the Facebook SDK, the Android application identifier
  of a third-party application must be registered on its Facebook application 
  settings page. This allows Facebook's Android application to respond to the 
  third-party application's access token request by verifying the application
  identifier in the intent to the one officially registered online. Only the 
  application identifer is needed and no secret key is compromised since it 
  is retrieved at runtime. This technique relies on the robustness of Android 
  since the source of the Android intent is assumed not to be spoofable.

Does anyone have a clearer description of this process. I've now read this extract three times and I'm none the wiser.

[1] http://www.cs.columbia.edu/~nieh/pubs/sigmetrics2014_playdro...

Facebook require you to create an "Application" on their developers website which corresponds to your Android app. Within the settings for your Facebook application you have to register details of your Android application - the package name and some sort of information on the key it's signed with (If my recall is correct - I've not done it for about 6 months).

Because you've registered this information, Facebook will only allow your app to perform actions if it not only has the correct API key but also matches the registered details. I suppose this means that if someone decompiles your app and steals your key they can't perform actions pretending to be you.

That's not true totally, since you can side load on Android it's trivial to spoof an App Identity to match what the facebook app is expecting. You can get the Identity from the original app. What is somewhat more difficult is doing this across a bunch of phones since the Play store won't register your app if it's spoofing another apps id. In the end it's just a series of hoops to jump through like almost all security. The more hoops you put between you and the bad guys the less it's worth jumping through them, in theory that is. There will always be the guy who has to know.

*edit I mean it's not true that the attacker can't impersonate your app. Your description of how it works looks right on to me. :)

It seems like the Facebook app on Android verifies the code signature of the requesting app. Seems like a very nice solution!

https://github.com/facebook/facebook-android-sdk/blob/master...

The Facebook application on Android probably verifies the integrity of the app originating the request by checking its code signature. Developers have to register their Android code signing certificate with Facebook.

The process is described here: https://developers.facebook.com/docs/android/getting-started...

The Facebook app for Android is closed source; however, the Facebook Android SDK seems to verify requests from the Facebook app in a similar way: https://github.com/facebook/facebook-android-sdk/blob/master...

I imagine that it works like that the other way around as well: Check whether the code signature of the Intent's sender matches the app developer certificate.

There is the whitebox concept that you can use here.