CODEWITHSUNDEEP
androidsecurityapk
Syed Fahad Sultan
Syed Fahad Sultan

Reputation: 508

Using app signature as secret key?

How safe is the app signature in android, obtained through the following code?

        sigs = this.getPackageManager().getPackageInfo(this.getPackageName(), PackageManager.GET_SIGNATURES).signatures;
        privateKey = sig[0].hashCode();

I am thinking of using the app's signature as a private key in communication with a web server. How secure is this approach?

Upvotes: 2

Views: 395

Answers (1)

Nikolay Elenkov
Nikolay Elenkov

Reputation: 52936

Absolutely insecure. The so called 'signature' is the signing certificate and anyone who can use WinZip can extract it from your APK. It is not meant to be secret, so don't treat it as such. If you want to communicate securely with a Web server use HTTPS (SSL).

Upvotes: 2

Related Questions