Lemme get this straight.. The password is hardcoded into Java code, so by decompiling it you can get that pw and break it? So essentially simple decompilation

Lemme get this straight.. The password is hardcoded into Java code, so by decompiling it you can get that pw and break it? So essentially simple decompilation was all that was needed? That's weak. What would have been some better alternatives to keep the encrypted files safe on the phone? Couldn't they have it call the server for a dynamic (safe) key?