5 ms·
I never understood this, the tutorial shows how to authenticate. mDbxAcctMgr = DbxAccountManager.getInstance(getApplicationContext(), APP_KEY, APP_SECRET); So
by qompiler 14y ago
I never understood this, the tutorial shows how to authenticate.
mDbxAcctMgr = DbxAccountManager.getInstance(getApplicationContext(), APP_KEY, APP_SECRET);
So anyone with some basic Android knowledge will be able to extract my applications key and secret?
- lucian1900 14y agoThe APP credentials are for each app that integrates this Dropbox sync. The app keeps those to itself (probably hard-coded in the binary) and using them, it requests access to a Dropbox account.
- TheAnimus 14y agoIs there a way round that thou? Surely you need to grant your app to be able to indentify itself, that means it has to have its secret baked in?
- adlpz 14y agoThere isn't really a way around it other than implementing authentication in a remote server. In that scenario, the app doesn't authenticate directly with the service, but with a private server. This way you can, for example, authenticate your users and create sessions before they can access the Dropbox API. It can still be abused, but at least you can know who did it.
- kalleboo 14y agoYes. This is also how Twitter's authentication works. Twitter say that client developers should protect the secret in the binary by reasonable means, but the key from Twitter's own iOS and Android apps have already been extracted. (on a side note, why haven't any client devs who ran into token limited tries using the official keys yet? will they be taken out of an app store?)
- lloeki 14y ago> why haven't any client devs who ran into token limited tries using the official keys yet? will they be taken out of an app store? Probably, just like AirFoil Speakers Touch has been kicked out for using some Apple private key extracted from the Airport firmware to act as an AirpLay receiver.
- thomseddon 14y agoEssentially no client side app can be considered able to keep secrets. I would be interested in the implications of this from the authorising servers perspective. Here is the main mention of it in the OAuth spec: http://tools.ietf.org/html/rfc6749#page-52 http://tools.ietf.org/html/rfc6749#page-52 and google's interpretation: https://developers.google.com/accounts/docs/OAuth2InstalledApp https://developers.google.com/accounts/docs/OAuth2InstalledA.... Even though google say "t is assumed that these applications cannot keep secrets" I can't quite infer the actual implications of this?
- thomseddon 14y agoIncidentally, this exact topic is now under discussion: http://news.ycombinator.com/item?id=5337099 http://news.ycombinator.com/item?id=5337099
- 1880 14y ago> So anyone with some basic Android knowledge will be able to extract my applications key and secret? Yes: http://news.ycombinator.com/item?id=4410398 http://news.ycombinator.com/item?id=4410398 http://stackoverflow.com/questions/4419915/how-to-keep-the-oauth-consumer-secret-safe-and-how-to-react-when-its-compromis http://stackoverflow.com/questions/4419915/how-to-keep-the-o...
- BHSPitMonkey 14y agoYep. And the same goes for iOS, too. I've taken a peek at the official Dropbox iOS app's API key and secret in the past just for fun, though I didn't go so far as to post them on Github.
- raq 14y agoHow about storing the key and secret in an encrypted form?