保护Android应用程序 [英] Securing an android application

问题描述

我已经'担保'我的Andr​​oid应用程序和TLS服务器提供金融交易服务，目前正在开发之间的沟通。

I have 'secured' the communication between my android application and a tls server providing a financial transaction service, currently in development.

凭据存储在BKS密钥库的安全性包括在Android APK。密码密钥库是在应用程序源代码的纯文本可见：

The security credentials are stored in a BKS keystore included in the Android apk. The password to the keystore is visible in plain text in the application source:


keyStore.load（就是passwd文件.toCharArray（））;


我担心，如果有人是逆向工程的应用程序，他们将能够冒充其他用户，并危及服务的安全性。

I am concerned that if someone was to reverse engineer the app, they would be able to impersonate another user and compromise the security of the service.

我不知道是否有我的执行出现故障，如果任何人有这种担心，什么保护这种可能性的最好的方法是。

I was wondering whether there is a fault in my implementation, if anyone else has this concern, and what the best method of securing against this possibility is.

推荐答案

我相信，<一个href=\"http://www.java2s.com/Tutorial/Java/0490__Security/ImplementingtheDiffieHellmankeyexchange.htm\"相对=nofollow>的Diffie-Hellman密钥交换就是我一直在寻找。我宁愿没有重新实现使用一个复杂的过程，其中涉及用户我DH的自己的版本。

I believe that Diffie-Hellman Key Exchange is what I was looking for. I'd rather not have to re-implement my own version of DH using a complicated process which involves the user.

这篇关于保护Android应用程序的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！