在应用程序中存储和保护私有API密钥的最佳实践

Most app developers will integrate some third party libraries into their apps. If it's to access a service, such as Dropbox or YouTube, or for logging crashes. The number of third party libraries and services is staggering. Most of those libraries and services are integrated by somehow authenticating with the service, most of the time, this happens through an API key. For security purposes, services usually generate a public and private, often also referred to as secret, key. Unfortunately, in order to connect to the services, this private key must be used to authenticate and hence, probably be part of the application. Needless to say, that this faces in immense security problem. Public and private API keys can be extracted from APKs in a matter of minutes and can easily be automated.

假设我有类似的东西，我如何保护密钥:

public class DropboxService  {

    private final static String APP_KEY = "jk433g34hg3";
    private final static String APP_SECRET = "987dwdqwdqw90";
    private final static AccessType ACCESS_TYPE = AccessType.DROPBOX;

    // SOME MORE CODE HERE

}

你认为储存私钥的最佳及最安全的方法是什么?混淆，加密，你怎么看?

当前回答

最安全的解决方案是将密钥保存在服务器上，并通过服务器路由所有需要该密钥的请求。这样，密钥就不会离开服务器，所以只要服务器是安全的，那么密钥也是安全的。当然，这种解决方案有性能成本。

2016-09-24 15:41:13

其他回答

将秘密保存在firebase数据库中，并在应用程序启动时从中获取，它比调用web服务好得多。

2018-03-27 07:56:19

Whatever you do to secure your secret keys is not going to be a real solution. If developer can decompile the application there is no way to secure the key, hiding the key is just security by obscurity and so is code obfuscation. Problem with securing a secret key is that in order to secure it you have to use another key and that key needs to also be secured. Think of a key hidden in a box that is locked with a key. You place a box inside a room and lock the room. You are left with another key to secure. And that key is still going to be hardcoded inside your application.

因此，除非用户输入PIN或短语，否则无法隐藏密钥。但要做到这一点，你必须有一个方案来管理发生在带外的pin码，这意味着通过不同的渠道。当然，对于谷歌api这样的服务来说，保护密钥是不实际的。

2016-12-15 16:27:44

app - secret密钥应该是私有的-但在发布应用程序时它们可以被某些人逆转。

对于那些家伙，它不会隐藏，锁定或ProGuard的代码。这是一个重构，一些付费的混淆器正在插入一些位操作符以恢复jk433g34hg3 字符串。如果你工作3天，你可以延长5 -15分钟的黑客时间:)

恕我直言，最好的办法就是保持现状。

即使你存储在服务器端(你的PC)，密钥也可能被黑客攻击并打印出来。也许这个花的时间最长?无论如何，在最好的情况下，这只是几分钟或几个小时的问题。

普通用户不会反编译你的代码。

2013-01-28 20:54:41

保持这些隐私的唯一方法是把它们保存在你的服务器上，让应用程序把它们发送到服务器上，然后服务器与Dropbox交互。这样你就不会以任何格式分发你的私钥。

2016-05-07 18:55:33

另一种方法是一开始就不要在设备上保存秘密!请参阅移动API安全技术(特别是第3部分)。

使用历史悠久的间接传统，分享API端点和应用程序身份验证服务之间的秘密。