3 ms·

So this relates to the API keys used by developers to access their own backend APIs and the APIs of third parties, such as Facebook or Twitter. There are sugge

by junto 12y ago

So this relates to the API keys used by developers to access their own backend APIs and the APIs of third parties, such as Facebook or Twitter. There are suggestions in comments here that you hide your third party API keys in your own backend server, and your app queries for the API keys and then makes the call from the client using the temporary downloaded keys. So how do you secure your own server's API keys? That's just a Russian doll implementation. I can't see a valid way to access an API key using a consumer key / secret without storing them in the application. Any suggestions?

junto 12y ago
Having read the paper [1], the authors suggest the following as a solution to the API key conundrum: To avoid the need of storing secret tokens on a mobile device, Facebook leverages the presence of the official Facebook Android application on Android devices. The Facebook SDK allows third-party applications to use Android intents to proxy requests for user access tokens through Facebook's Android application, where the user is already authenticated. To retrieve a user's access token with the Facebook SDK, the Android application identifier of a third-party application must be registered on its Facebook application settings page. This allows Facebook's Android application to respond to the third-party application's access token request by verifying the application identifier in the intent to the one officially registered online. Only the application identifer is needed and no secret key is compromised since it is retrieved at runtime. This technique relies on the robustness of Android since the source of the Android intent is assumed not to be spoofable. Does anyone have a clearer description of this process. I've now read this extract three times and I'm none the wiser. [1] http://www.cs.columbia.edu/~nieh/pubs/sigmetrics2014_playdrone.pdf http://www.cs.columbia.edu/~nieh/pubs/sigmetrics2014_playdro...
- leoedin 12y ago
  Facebook require you to create an "Application" on their developers website which corresponds to your Android app. Within the settings for your Facebook application you have to register details of your Android application - the package name and some sort of information on the key it's signed with (If my recall is correct - I've not done it for about 6 months). Because you've registered this information, Facebook will only allow your app to perform actions if it not only has the correct API key but also matches the registered details. I suppose this means that if someone decompiles your app and steals your key they can't perform actions pretending to be you.
  - jaegerpicker 12y ago
    That's not true totally, since you can side load on Android it's trivial to spoof an App Identity to match what the facebook app is expecting. You can get the Identity from the original app. What is somewhat more difficult is doing this across a bunch of phones since the Play store won't register your app if it's spoofing another apps id. In the end it's just a series of hoops to jump through like almost all security. The more hoops you put between you and the bad guys the less it's worth jumping through them, in theory that is. There will always be the guy who has to know. *edit I mean it's not true that the attacker can't impersonate your app. Your description of how it works looks right on to me. :)
    - lxgr 12y ago
      It seems like the Facebook app on Android verifies the code signature of the requesting app. Seems like a very nice solution! https://github.com/facebook/facebook-android-sdk/blob/master/facebook/src/com/facebook/internal/NativeProtocol.java#L193 https://github.com/facebook/facebook-android-sdk/blob/master...
- lxgr 12y ago
  The Facebook application on Android probably verifies the integrity of the app originating the request by checking its code signature. Developers have to register their Android code signing certificate with Facebook. The process is described here: https://developers.facebook.com/docs/android/getting-started/ https://developers.facebook.com/docs/android/getting-started... The Facebook app for Android is closed source; however, the Facebook Android SDK seems to verify requests from the Facebook app in a similar way: https://github.com/facebook/facebook-android-sdk/blob/master/facebook/src/com/facebook/internal/NativeProtocol.java#L193 https://github.com/facebook/facebook-android-sdk/blob/master... I imagine that it works like that the other way around as well: Check whether the code signature of the Intent's sender matches the app developer certificate.
baby 12y ago
There is the whitebox concept that you can use here.

by junto 12y ago

junto 12y ago

Having read the paper [1], the authors suggest the following as a solution to the API key conundrum: To avoid the need of storing secret tokens on a mobile device, Facebook leverages the presence of the official Facebook Android application on Android devices. The Facebook SDK allows third-party applications to use Android intents to proxy requests for user access tokens through Facebook's Android application, where the user is already authenticated. To retrieve a user's access token with the Facebook SDK, the Android application identifier of a third-party application must be registered on its Facebook application settings page. This allows Facebook's Android application to respond to the third-party application's access token request by verifying the application identifier in the intent to the one officially registered online. Only the application identifer is needed and no secret key is compromised since it is retrieved at runtime. This technique relies on the robustness of Android since the source of the Android intent is assumed not to be spoofable. Does anyone have a clearer description of this process. I've now read this extract three times and I'm none the wiser. [1] http://www.cs.columbia.edu/~nieh/pubs/sigmetrics2014_playdrone.pdf http://www.cs.columbia.edu/~nieh/pubs/sigmetrics2014_playdro...

leoedin 12y ago
Facebook require you to create an "Application" on their developers website which corresponds to your Android app. Within the settings for your Facebook application you have to register details of your Android application - the package name and some sort of information on the key it's signed with (If my recall is correct - I've not done it for about 6 months). Because you've registered this information, Facebook will only allow your app to perform actions if it not only has the correct API key but also matches the registered details. I suppose this means that if someone decompiles your app and steals your key they can't perform actions pretending to be you.
- jaegerpicker 12y ago
  That's not true totally, since you can side load on Android it's trivial to spoof an App Identity to match what the facebook app is expecting. You can get the Identity from the original app. What is somewhat more difficult is doing this across a bunch of phones since the Play store won't register your app if it's spoofing another apps id. In the end it's just a series of hoops to jump through like almost all security. The more hoops you put between you and the bad guys the less it's worth jumping through them, in theory that is. There will always be the guy who has to know. *edit I mean it's not true that the attacker can't impersonate your app. Your description of how it works looks right on to me. :)
  - lxgr 12y ago
    It seems like the Facebook app on Android verifies the code signature of the requesting app. Seems like a very nice solution! https://github.com/facebook/facebook-android-sdk/blob/master/facebook/src/com/facebook/internal/NativeProtocol.java#L193 https://github.com/facebook/facebook-android-sdk/blob/master...
lxgr 12y ago
The Facebook application on Android probably verifies the integrity of the app originating the request by checking its code signature. Developers have to register their Android code signing certificate with Facebook. The process is described here: https://developers.facebook.com/docs/android/getting-started/ https://developers.facebook.com/docs/android/getting-started... The Facebook app for Android is closed source; however, the Facebook Android SDK seems to verify requests from the Facebook app in a similar way: https://github.com/facebook/facebook-android-sdk/blob/master/facebook/src/com/facebook/internal/NativeProtocol.java#L193 https://github.com/facebook/facebook-android-sdk/blob/master... I imagine that it works like that the other way around as well: Check whether the code signature of the Intent's sender matches the app developer certificate.

baby 12y ago

There is the whitebox concept that you can use here.