Safe to hard code a password in mobile app

Question

I have a web server that creates a QR code which is [username] + a md5 hash of [username][password]. Where [username] is the user logged in at the time. Where [password] is a system password set by me and common to web server and the apps.

My Android/iPhone/BlackBerry/Windows app will scan this QR code and use the [username] provided in the QR code to hash with [password] which will tell me that the QR code came from my server.

Obviously if someone were to get hold of [password] then they could create QR codes that did not come from my web server. So is there anyway to safely store [password] in my app or could someone decompile the .apk and find it in classes.dex?

Answer 1

No.

If someone is sufficiently motivated, they will be able to reverse engineer a hard-coded password.

Answer 2

You can obfuscate the password somehow, but ultimately this is only security through obscurity. Someone who wanted to could certainly reverse engineer it.

You probably want to look at public key cryptography to avoid this - even if someone gets access to the public key, they still won't be able to use it to impersonate your server.

Answer 3

Im not sure about the other platforms, but if you put your password hardcoded in plaintext on android they would get it really easily. Other platforms might require more advanced methods. You can hash the password with some more advanced hashing algorithm so that they don't get the original password, but from what you said you don't want them making "fake" QR codes.

The short answer is no, because everything can be cracked somehow if it is on client side.