3 ms·
If you want a solution that isn't perfect, but is at least slightly better: Store the key in your code but in a basic encrypted string, and then decrypt it at
by tikkun 4y ago
If you want a solution that isn't perfect, but is at least slightly better:
Store the key in your code but in a basic encrypted string, and then decrypt it at runtime.
Yes, it's still easy to get if someone is motivated, but it's a lot harder to read the machine calls figuring out what method was used to encrypt the string (make it a method that can't be figured out from only the encrypted string), than it is to read the plaintext key from the Plist.
Bad in theory, helpful in practice.
- weird-eye-issue 4y agoFine for some secrets but I'd never do with something like an OpenAI key. Somebody could blow through your entire months's usage allowance before you notice anything
- andrewmunsell 4y agoAs others have mentioned in the thread, this doesn't guard against a MITM proxy and it'd take a couple minutes to defeat this. You're much better off proxying calls from your own server API, having proper rate limits and authentication, and a strict API surface that doesn't permit arbitrary calls to whatever APIs you depend on