3 ms·
Having read the paper [1], the authors suggest the following as a solution to the API key conundrum: To avoid the need of storing secret tokens on a mobile
by junto 12y ago
Having read the paper [1], the authors suggest the following as a solution to the API key conundrum:
To avoid the need of storing secret tokens on a mobile device, Facebook
leverages the presence of the official Facebook Android application on
Android devices. The Facebook SDK allows third-party applications to use
Android intents to proxy requests for user access tokens through Facebook's
Android application, where the user is already authenticated. To retrieve a
user's access token with the Facebook SDK, the Android application identifi er
of a third-party application must be registered on its Facebook application
settings page. This allows Facebook's Android application to respond to the
third-party application's access token request by verifying the application
identi fier in the intent to the one officially registered online. Only the
application identi fer is needed and no secret key is compromised since it
is retrieved at runtime. This technique relies on the robustness of Android
since the source of the Android intent is assumed not to be spoofable.
Does anyone have a clearer description of this process. I've now read this extract three times and I'm none the wiser.
[1] http://www.cs.columbia.edu/~nieh/pubs/sigmetrics2014_playdrone.pdf http://www.cs.columbia.edu/~nieh/pubs/sigmetrics2014_playdro...
- leoedin 12y agoFacebook require you to create an "Application" on their developers website which corresponds to your Android app. Within the settings for your Facebook application you have to register details of your Android application - the package name and some sort of information on the key it's signed with (If my recall is correct - I've not done it for about 6 months). Because you've registered this information, Facebook will only allow your app to perform actions if it not only has the correct API key but also matches the registered details. I suppose this means that if someone decompiles your app and steals your key they can't perform actions pretending to be you.
- jaegerpicker 12y agoThat's not true totally, since you can side load on Android it's trivial to spoof an App Identity to match what the facebook app is expecting. You can get the Identity from the original app. What is somewhat more difficult is doing this across a bunch of phones since the Play store won't register your app if it's spoofing another apps id. In the end it's just a series of hoops to jump through like almost all security. The more hoops you put between you and the bad guys the less it's worth jumping through them, in theory that is. There will always be the guy who has to know. *edit I mean it's not true that the attacker can't impersonate your app. Your description of how it works looks right on to me. :)
- lxgr 12y agoIt seems like the Facebook app on Android verifies the code signature of the requesting app. Seems like a very nice solution! https://github.com/facebook/facebook-android-sdk/blob/master/facebook/src/com/facebook/internal/NativeProtocol.java#L193 https://github.com/facebook/facebook-android-sdk/blob/master...
- lxgr 12y agoThe Facebook application on Android probably verifies the integrity of the app originating the request by checking its code signature. Developers have to register their Android code signing certificate with Facebook. The process is described here: https://developers.facebook.com/docs/android/getting-started/ https://developers.facebook.com/docs/android/getting-started... The Facebook app for Android is closed source; however, the Facebook Android SDK seems to verify requests from the Facebook app in a similar way: https://github.com/facebook/facebook-android-sdk/blob/master/facebook/src/com/facebook/internal/NativeProtocol.java#L193 https://github.com/facebook/facebook-android-sdk/blob/master... I imagine that it works like that the other way around as well: Check whether the code signature of the Intent's sender matches the app developer certificate.