walterf25 Expert Licensed User Longtime User Sep 27, 2024 #1 Hi all, I have been trying to upload an app to the google play store which I haven't done in a very long time, seems like a lot of things have changed. I am getting an error saying that my GCP key is exposed, I came a few threads in the forum and I have already limited my key to only my app by entering my app ID and hash, now I need to obfuscate the API_KEY variable that holds my firebase api_key, I read somewhere @Erel suggests placing this variable in a Process_Global which I have done but when I look at the ObfuscatorMap.txt file I don't see that variable there, am I missing something? Or do these variables get obfuscated but I just can't see them, how does this work? Thanks, Walter
Hi all, I have been trying to upload an app to the google play store which I haven't done in a very long time, seems like a lot of things have changed. I am getting an error saying that my GCP key is exposed, I came a few threads in the forum and I have already limited my key to only my app by entering my app ID and hash, now I need to obfuscate the API_KEY variable that holds my firebase api_key, I read somewhere @Erel suggests placing this variable in a Process_Global which I have done but when I look at the ObfuscatorMap.txt file I don't see that variable there, am I missing something? Or do these variables get obfuscated but I just can't see them, how does this work? Thanks, Walter
Erel B4X founder Staff member Licensed User Longtime User Sep 27, 2024 #2 Strings set in Process_Globals are obfuscated. You will not see it in the map file. You can see it by decompiling classes.dex. Note that a determinate hacker will be able to deobfuscate the string quite easily. Upvote 0
Strings set in Process_Globals are obfuscated. You will not see it in the map file. You can see it by decompiling classes.dex. Note that a determinate hacker will be able to deobfuscate the string quite easily.
walterf25 Expert Licensed User Longtime User Sep 27, 2024 #3 Erel said: Strings set in Process_Globals are obfuscated. You will not see it in the map file. You can see it by decompiling classes.dex. Note that a determinate hacker will be able to deobfuscate the string quite easily. Click to expand... What is the best way or best practice in this case to hide the API_KEY? Upvote 0
Erel said: Strings set in Process_Globals are obfuscated. You will not see it in the map file. You can see it by decompiling classes.dex. Note that a determinate hacker will be able to deobfuscate the string quite easily. Click to expand... What is the best way or best practice in this case to hide the API_KEY?
hatzisn Expert Licensed User Longtime User Sep 27, 2024 #4 walterf25 said: What is the best way or best practice in this case to hide the API_KEY? Click to expand... I suppose not include it in the app but have it in a server (or some servers) and restrict the key to the IPs of these servers driving the app to make requests to this server or the load balancer of the bunch of servers. Upvote 0
walterf25 said: What is the best way or best practice in this case to hide the API_KEY? Click to expand... I suppose not include it in the app but have it in a server (or some servers) and restrict the key to the IPs of these servers driving the app to make requests to this server or the load balancer of the bunch of servers.
Robert Valentino Well-Known Member Licensed User Longtime User Sep 27, 2024 #5 Maybe I'm way off here but couldn't you encrypt the string and just store the encrypted value and decrypt it in the program Sure a determined hacker would realize that but the string in its normal form would not be visible?? Upvote 0
Maybe I'm way off here but couldn't you encrypt the string and just store the encrypted value and decrypt it in the program Sure a determined hacker would realize that but the string in its normal form would not be visible??
Erel B4X founder Staff member Licensed User Longtime User Sep 29, 2024 #6 The answer is specific to the type and importance of the key. Storing a "server" key in a public mobile app for example is a mistake. If this is a mobile app key then you are expected to store it in some way in your app. Limiting the key based on the apk signature is usually enough. Upvote 0
The answer is specific to the type and importance of the key. Storing a "server" key in a public mobile app for example is a mistake. If this is a mobile app key then you are expected to store it in some way in your app. Limiting the key based on the apk signature is usually enough.
