3 ms·

If the key is published as part of the APK, it is already public. Not committing it on github doesn't really reduce exposure.

pmtarantino 10y ago
I never developed an app so I dont know, but if you cant include in the APK because people can decode it, how do you distribute keys and secret strings?
- iokanuon 10y ago
  You do it like that and just hope people won't abuse it.
- PeterisP 10y ago
  What secret strings? You distribute user-specific secrets after a user has logged in over a secure channel. You don't get to have app-specific secrets - since anybody can get and run the app (and modify it!), nothing in it has a reason to be secret. This means that you don't get to have an API that's available only through that app and with limitations set by that app. If you use a third-party API that requires you to enforce limits on its use (e.g. that end users can't redistribute access to that API), this means that you can't meet the requirements of that API licencing.
deleted 10y ago
[deleted]
distances 10y ago
That's a very technical viewpoint. The API agreement tells not to share the key, which obviously does not mean you can't include it in the app binary. I interpret that as not being allowed to publish the key with the source code though.
- krick 10y ago
  That's pretty weird and questionable interpretation, since if I have a binary — I have the key, even if in some obfuscated form (even that isn't usually true with APKs though), but whatever, if it works for you — fine, then I have a solution to your problem. Don't include API_KEY in the published source, include rot13(API_KEY).
  - distances 10y ago
    You have to consider the intention of the service provider, which in this case is more geared towards mobile clients than web services. It's perfectly clear that binaries will include the API key, no interpretation needed on that part. It's the source code part that is open to interpretation. I could of course just ask for explicit permission for that.
    - krick 10y ago
      So rot13 should work as fine as that, I'd assume. You wouldn't publish API_KEY this way, would you?
      - distances 10y ago
        In a sense, perhaps. But I feel that's just technical trickery on a reasonable request, so I don't see myself bothering with such workarounds.

pmtarantino 10y ago

I never developed an app so I dont know, but if you cant include in the APK because people can decode it, how do you distribute keys and secret strings?

iokanuon 10y ago
You do it like that and just hope people won't abuse it.
PeterisP 10y ago
What secret strings? You distribute user-specific secrets after a user has logged in over a secure channel. You don't get to have app-specific secrets - since anybody can get and run the app (and modify it!), nothing in it has a reason to be secret. This means that you don't get to have an API that's available only through that app and with limitations set by that app. If you use a third-party API that requires you to enforce limits on its use (e.g. that end users can't redistribute access to that API), this means that you can't meet the requirements of that API licencing.

deleted 10y ago

[deleted]

distances 10y ago

That's a very technical viewpoint. The API agreement tells not to share the key, which obviously does not mean you can't include it in the app binary. I interpret that as not being allowed to publish the key with the source code though.

krick 10y ago
That's pretty weird and questionable interpretation, since if I have a binary — I have the key, even if in some obfuscated form (even that isn't usually true with APKs though), but whatever, if it works for you — fine, then I have a solution to your problem. Don't include API_KEY in the published source, include rot13(API_KEY).
- distances 10y ago
  You have to consider the intention of the service provider, which in this case is more geared towards mobile clients than web services. It's perfectly clear that binaries will include the API key, no interpretation needed on that part. It's the source code part that is open to interpretation. I could of course just ask for explicit permission for that.
  - krick 10y ago
    So rot13 should work as fine as that, I'd assume. You wouldn't publish API_KEY this way, would you?
    - distances 10y ago
      In a sense, perhaps. But I feel that's just technical trickery on a reasonable request, so I don't see myself bothering with such workarounds.