3 ms·
Facebook require you to create an "Application" on their developers website which corresponds to your Android app. Within the settings for your Facebook applica
by leoedin 12y ago
Facebook require you to create an "Application" on their developers website which corresponds to your Android app. Within the settings for your Facebook application you have to register details of your Android application - the package name and some sort of information on the key it's signed with (If my recall is correct - I've not done it for about 6 months).
Because you've registered this information, Facebook will only allow your app to perform actions if it not only has the correct API key but also matches the registered details. I suppose this means that if someone decompiles your app and steals your key they can't perform actions pretending to be you.
- jaegerpicker 12y agoThat's not true totally, since you can side load on Android it's trivial to spoof an App Identity to match what the facebook app is expecting. You can get the Identity from the original app. What is somewhat more difficult is doing this across a bunch of phones since the Play store won't register your app if it's spoofing another apps id. In the end it's just a series of hoops to jump through like almost all security. The more hoops you put between you and the bad guys the less it's worth jumping through them, in theory that is. There will always be the guy who has to know. *edit I mean it's not true that the attacker can't impersonate your app. Your description of how it works looks right on to me. :)
- lxgr 12y agoIt seems like the Facebook app on Android verifies the code signature of the requesting app. Seems like a very nice solution! https://github.com/facebook/facebook-android-sdk/blob/master/facebook/src/com/facebook/internal/NativeProtocol.java#L193 https://github.com/facebook/facebook-android-sdk/blob/master...