3 ms·

Is there any way to hide keys from the extractions? I tried it before and ended up to find that users can do that if they really want to.

petjuh 7y ago
No, but I think the idea is to create a web API that connects to the database instead of having the phone connect directly to it.
bootloop 7y ago
No, you can only obfuscate it but the correct way to do this is to limit the access scope of the access key.
yoginth 7y ago
I think we can't hide keys up to my knowledge! But make sure you just switched firebase to production mode. In my case, the firebase was in development mode and the data is available public! https://yoginth.com/college-hack#mitigations https://yoginth.com/college-hack#mitigations
- evolveyourmind 7y ago
  It’s not about keys or modes, it’s about the rules they didn’t set up. Everyone uses firebase like that. Those “keys” are required to allow you to connect to the correct firebase app, nothing more. You don’t get any direct special permission to do things on the database or storage. Here some more info about the rules: https://firebase.google.com/docs/database/security https://firebase.google.com/docs/database/security
whymauri 7y ago
I'm not a mobile dev, but aren't there utilities like KeyStore for this? https://developer.android.com/training/articles/keystore.html https://developer.android.com/training/articles/keystore.htm...
- bootloop 7y ago
  Well, the trick is that using a KeyStore ensures that the key doesn't leak into the application (but is only used for cryptographic operations in a trusted environment). However, you would need the plain key to authenticate against the database so using this wouldn't work.
  - whymauri 7y ago
    Gotcha, I see the problem now.
diericx 7y ago
Firebase keys give you access to the database, which can be public. You just have to setup rules for the database, usually so users have to be authenticated to view anything and can only read their own private info. edit: just realized you may have just been asking about hiding keys in general. Sorry if this wasn't what you were asking about!
- hyperthreading 7y ago
  > Don’t put your API keys, Tokens and Secrets visible easily I was just confused at this part because permission & rules are the solution as far as I know. Thanks for the reply though :) I'm prettry sure now that exposing keys are no problem.
noja 7y ago
Read-only access through intermediate proxy that you control (but not to all data like here) + login required for more access (via intermediate proxy or direct).
q3k 7y ago
No, you can just obfuscate it and make it painful to extract to potential reverse engineers.

petjuh 7y ago

No, but I think the idea is to create a web API that connects to the database instead of having the phone connect directly to it.

bootloop 7y ago

No, you can only obfuscate it but the correct way to do this is to limit the access scope of the access key.

yoginth 7y ago

I think we can't hide keys up to my knowledge! But make sure you just switched firebase to production mode. In my case, the firebase was in development mode and the data is available public! https://yoginth.com/college-hack#mitigations https://yoginth.com/college-hack#mitigations

evolveyourmind 7y ago
It’s not about keys or modes, it’s about the rules they didn’t set up. Everyone uses firebase like that. Those “keys” are required to allow you to connect to the correct firebase app, nothing more. You don’t get any direct special permission to do things on the database or storage. Here some more info about the rules: https://firebase.google.com/docs/database/security https://firebase.google.com/docs/database/security

whymauri 7y ago

I'm not a mobile dev, but aren't there utilities like KeyStore for this? https://developer.android.com/training/articles/keystore.html https://developer.android.com/training/articles/keystore.htm...

bootloop 7y ago
Well, the trick is that using a KeyStore ensures that the key doesn't leak into the application (but is only used for cryptographic operations in a trusted environment). However, you would need the plain key to authenticate against the database so using this wouldn't work.
- whymauri 7y ago
  Gotcha, I see the problem now.

diericx 7y ago

Firebase keys give you access to the database, which can be public. You just have to setup rules for the database, usually so users have to be authenticated to view anything and can only read their own private info. edit: just realized you may have just been asking about hiding keys in general. Sorry if this wasn't what you were asking about!

hyperthreading 7y ago
> Don’t put your API keys, Tokens and Secrets visible easily I was just confused at this part because permission & rules are the solution as far as I know. Thanks for the reply though :) I'm prettry sure now that exposing keys are no problem.

noja 7y ago

Read-only access through intermediate proxy that you control (but not to all data like here) + login required for more access (via intermediate proxy or direct).

q3k 7y ago

No, you can just obfuscate it and make it painful to extract to potential reverse engineers.