4 ms·
> he will be able to see my power consumption, see who called, listen to voice messages, and so on So is your API key baked into the app? Implement a login scr
by Kerbonut 2y ago
> he will be able to see my power consumption, see who called, listen to voice messages, and so on
So is your API key baked into the app? Implement a login screen or a field for the API key and then who cares if Google has a copy of your app, they can't access your data.
- qwertox 2y agoThere is no API key. The URLs are not public, not guessable, and traffic runs over HTTPS. Any attempt at accessing a wrongly guessed URL bans the IP address. I have no intention to rewrite this stuff. You need to have the app to get to know the URLs.
- jpc0 2y agoRandomly generated url (even by a bad random generator like a human) is equivalent to an API key. Your exact same argument you made about the url can be made about a baked in API key. Implement auth, do extremely basic auth if you have to using http basic auth over https and check against a hardcoded value on the server, it's not secure by any stretch of the imagination but is better than giving "api keys" to any intermediary that can do a string dump on your APK...