It is still possible to get the keys by modifying the app about hidden-secrets-gradle-plugin HOT 7 CLOSED

We can compare application signature at runtime inside JNI. If signature is matching then only return key else don't return key.

from hidden-secrets-gradle-plugin.

Hello @Irineu333 ,

1/ the app you are showing does not look obfuscated ? It will be much harder to do the same in a production's app.
2/ If you run a libsecrets.so in another app it won't have the correct key and package name to read the hidden keys.

from hidden-secrets-gradle-plugin.

1. obfuscation would make it difficult, but it would still be possible
2. i didn't understand what this key would be, but as for the package, what prevents someone from creating an application with the same package? in fact, it wouldn't even be necessary, since the package is passed as an argument, an app with package x could code a package y

I think a more robust way to check the package would be to pass a context and call getPackageName, rather than relying on what the bytecode passed

from hidden-secrets-gradle-plugin.

@ben-j69 what would this "correct key" be? did i miss something? 🤔

from hidden-secrets-gradle-plugin.

@ben-j69 I can't run the libsecrets.so files in an app other than the one they were compiled, but I don't know if it's my lack of knowledge or it's really not possible, but there's still the issue of tampering with the app

I'm trying to code a signature check but it's too complicated

from hidden-secrets-gradle-plugin.

@Irineu333 as said in Readme:

⚠️ Nothing on the client-side is unbreakable. So generally speaking, keeping a secret in a mobile package is not a smart idea. But when you absolutely need to, this is the best method we have found to hide it.

You should try to investigate with real obfuscated code, it is much more difficult to get what you want. It will be long and difficult to find the necessary info to reveal the hidden keys.

from hidden-secrets-gradle-plugin.

@kalpesh2704 It's a great solution!

from hidden-secrets-gradle-plugin.