Protect string constant against reverse-engineerin

Question

I have android application that has hard coded (static string constants) credentials (user/pass) for sending emails via SMTP.

The problem is that .dex file in .apk can be easily reverse-engineered and everybody can see my password.

Is there a way how to secure these credentials, while i will still be able to use them in my classes?

Answer 1

If you do not have the means to do a web authorization you will need to include the third party decryption with you application.

This is what you could try 1) Write a standalone program only to create a password hash one time. (This program should not be a part of your app). Make a note of the hash that was generated. http://www.mindrot.org/projects/jBCrypt/

 // Hash a password for the first time.
    String hashed = BCrypt.hashpw(password, BCrypt.gensalt(12));

2) Store this password hash as a String constant in you APK.

3) Then every time you need to check the password, compare with the hashed password, using bcrypt.

// Check that an unencrypted password matches one that has
// previously been hashed
if (BCrypt.checkpw(candidate, hashed))
    System.out.println("It matches");
else
    System.out.println("It does not match");

jBCrypt is a single java file and it can be directly included in your application. It is considered one of the strongest encryption algorithms for passwords. Even through the decryption algorithm is present in you APK, trying to break this is very time consuming details of which can be read in the article below.

Read this article for details and security of bcrypt.
http://codahale.com/how-to-safely-store-a-password/

Again, use this only if you do not have the means to do web based authentication.

Answer 2

1. Hashing is not possible since it is not two way.
2. Any encryption such as AES, DES, blowfish, etch is not a viable solution as you have to include the decryption part within your app and that can be decompiled with a combination of apktool, dex2jar and JD (java decompiler) which is a very powerful combo while decompiling any apk.
3. Even code obfuscators don't do anything except make life a little more difficult for the decompiling guy, who'll eventually get it anyways.

The only way which I think would work to an extent would be to host the credentials on a server which only your application can access via a web-service call through a separate authentication of some kind - similar to FB's hash key thing. If it works for them, it should work for us.

Answer 3

I guess you can try a code obfuscator, but really that won't make your password 100% secure and I don't know how well it goes along with the android compiler. Why not use a secured web authentication , like that of Google?