Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thousands of secret keys found in Android apps

cnet.com

Post reply on HN
Print view View original

11–20 of 40 posts

Re: Thousands of secret keys found in Android apps

#11

Post by matlecu »

girvo wrote: post #9
matlecu wrote: post #5

Earlier quoted context omitted.

Some APIs should be accessed from your backend, not the app (eg the user can authorize you on Facebook without you sharing your API app secret). The paper also says they found amazon tokens, with which you can spawn instances. I think you can use other kind of authentication that don't give access to the whole account.

What if you app doesn't have a backend? That's an honest question, I've been trying to come up with some way of using authe/autho keys on a fully client-side app (be it a mobile or desktop one) that is still secure; I can't think of a way to, as to communicate it requires the keys to be in memory, thus, vulnerable. I dunno. I've wondered about all this myself quite a lot, perhaps its a non-issue?

Yes I don't know of any good solution for client side only applications. And it's a real issue I think. For instance if I have your key, it may be possible for me to access data, post on behalf, etc... of people who signed in with the service on your application

Re: Thousands of secret keys found in Android apps

#12

Post by AUmrysh »

girvo wrote: post #9
matlecu wrote: post #5

Earlier quoted context omitted.

Some APIs should be accessed from your backend, not the app (eg the user can authorize you on Facebook without you sharing your API app secret). The paper also says they found amazon tokens, with which you can spawn instances. I think you can use other kind of authentication that don't give access to the whole account.

What if you app doesn't have a backend? That's an honest question, I've been trying to come up with some way of using authe/autho keys on a fully client-side app (be it a mobile or desktop one) that is still secure; I can't think of a way to, as to communicate it requires the keys to be in memory, thus, vulnerable. I dunno. I've wondered about all this myself quite a lot, perhaps its a non-issue?

I think your only choice for doing this securely is to hide the keys behind your own server.

Re: Thousands of secret keys found in Android apps

#14

Post by Groxx »

lostmsu wrote: post #3

What are the alternatives? You have to ship secret keys with your app to be able to access public APIs

Frequently: none. Well, you could proxy the request through your servers, but that could get relatively costly.

Ideally: either the service allows you to generate short-lived tokens (server-side, ideally without a request to the service), or you sign requests for the client. In the latter, you generally gain some measure control over what apps can do, with relatively small cost. Basically that's what you can do with S3 file uploads - your server can generate a signed URL, then the client can upload to it, all while you retain complete control of your API secrets.

Re: Thousands of secret keys found in Android apps

#15

Post by derefr »

jrochkind1 wrote: post #4

> This can mean several things, but it also means that users can never be 100 percent certain that the app they are downloading is entirely secure. I wonder in what circumstances the author thinks users can be 100% certain that the app they are downloading is entirely secure. Cause, yeah, there aren't any.

Presumably, if

1. the user is side-loading an app they wrote themselves (or is an internal Apple/Google developer who uploaded an app to their app store and audited the entire sausage-making process as it transpired),

and 2. the app does literally nothing,

then the user can be 100 percent certain that the app does what it does securely.

Re: Thousands of secret keys found in Android apps

#17

Post by cheald »

matlecu wrote: post #5
lostmsu wrote: post #3

What are the alternatives? You have to ship secret keys with your app to be able to access public APIs

Some APIs should be accessed from your backend, not the app (eg the user can authorize you on Facebook without you sharing your API app secret). The paper also says they found amazon tokens, with which you can spawn instances. I think you can use other kind of authentication that don't give access to the whole account.

AWS keys should belong to IAM users who have constrained permissions to only perform the things you want them to perform.

If you're shipping root account AWS keys in any app, you're doing it wrong.

Re: Thousands of secret keys found in Android apps

#19

Post by junto »

So this relates to the API keys used by developers to access their own backend APIs and the APIs of third parties, such as Facebook or Twitter.

There are suggestions in comments here that you hide your third party API keys in your own backend server, and your app queries for the API keys and then makes the call from the client using the temporary downloaded keys.

So how do you secure your own server's API keys? That's just a Russian doll implementation.

I can't see a valid way to access an API key using a consumer key / secret without storing them in the application.

Any suggestions?

Re: Thousands of secret keys found in Android apps

#20

Post by x0054 »

I am surprised that more developers do not run a code scrambler on their code before compiling a release. Also, why would you name the variable where you store the key "FACEBOOK_CUSTOMER_SECRET" rather than "AKED223KWN" or something else random. And, why wouldn't you at least pad and scramble the key, so it would be a little harder to pick it out of memory.
Post reply on HN