Thousands of secret keys found in Android apps

Re:Thousands of secret keys found in Android apps by chr7z on Thursday June 19, 2014 @04:46AM (#7915220)

There is a tool for moving API keys out of the source: Keystok stores encrypted API keys and tokes in a cloud service and lets the App / client retrieve them during runtime.

Its not just about moving keys out of the source, but about getting rid of local config files altogether. Related post on their blog: http://blog.keystok.com/why-i-stopped-using-local-config-fil...

Disclosure: I'm a developer at Keystok.

[ Parent | on HN ]

Re:Thousands of secret keys found in Android apps by kuschku on Thursday June 19, 2014 @05:48AM (#7915378)

And a developer with Apktool could still modify the app and get the keys, you win nothing with this solution.

[ Parent | on HN ]

Re:Thousands of secret keys found in Android apps by lucian1900 on Thursday June 19, 2014 @05:28AM (#7915332)

That is much worse, though: you're actively disclosing your API keys to a third party (keystok).

[ Parent | on HN ]