Android版Firebase实时（在线）数据库的安全性如何？ [英] How Secure is Firebase Real-time (Online) database for Android?

问题描述

我刚刚开始使用Google的 firebase 作为Android应用数据的在线集中式数据库（从使用本地sqlite）。

I have just recently started using Google's firebase as an online centralized database for android apps data (migrating from using local sqlite).

作为firebase的新手我想问一下android的firebase在线数据库有多安全？

Being a newbie on firebase I would like to ask how secure is the firebase online database for android?

从以下主题中读取，看起来任何能够访问google-services.json的人都可以插入和修改我的firebase数据库中的在线数据吗？

Reading from the following threads, does it really seem like anyone who can get access to google-services.json can insert and modify online data from my firebase database?

• 我应该将google-services.json（来自Firebase）添加到我的存储库吗？


• google-services.json是否可以免受黑客攻击？

• Should I add the google-services.json (from Firebase) to my repository?
• Is google-services.json safe from hackers?

我担心任何人都可以访问反编译的apk配置文件（google-services.json）可以在他们的Android项目中使用它，比如说，创建一个具有类似包名称和推送恶意数据或的Android应用程序从我的firebase数据库中删除。

I am concerned how anyone who can get access to a decompiled apk's configuration file (google-services.json) can use it in their android project, say, to create an android app with a similar package name and push malicious data or delete from my firebase database.

如果有新的和聪明的解决办法使在线数据库更安全，你能提供建议吗？

Can you give advice if there are new and clever workarounds to making the online database more secure?

到目前为止，为了增加安全性，我试图：

So far to add security, I have tried to:

1. 编辑firebase的数据库规则：

{
  "rules": {
    ".read": "auth != null",
    ".write": "auth != null"
  }
}

1. 将firebase电子邮件/密码验证添加到我的应用程序以控制登录。

1. Add firebase Email/Password authentication to my app to control login.

然而，我发现即使没有身份验证功能，新创建的应用程序仍然可以将数据推送和修改到在线firebase数据库中，只需使用hackedgoogle-services.json。

However, I find that newly-created apps even without the authentication feature can still push and modify data into the online firebase database, just by using the "hacked" google-services.json.

感谢您的意见和建议！

推荐答案

欢迎来到有效的双层系统的乐趣。你可以做几件事来保护你的数据 - 但不是免费的。

Welcome to the joys of what effectively is a two tier system. You can do several things to protect your data - but not for free.

首先是一些事实：

1. 拥有数据库凭据的人可以访问它


2. 如果应用程序可以访问数据，那么任何可以从中提取数据库的人都可以有效地使用您的数据库凭据你的应用程序

有一些对策可以提高攻击者的标准，但是一个坚定的（或幸运的）攻击者可以获得访问权限。如果他有权进入，很难阻止他造成伤害，例如更改数据库凭据也会强制所有用户更新。

There are counter measures that can raise the bar for an attacker, but a determined (or lucky) attacker can get access. And if he has access it is very difficult to prevent him from doing damage because e.g. changing the DB credentials will also force all of your users to update.

您可以做的是

1. 决定保护数据是不值得的，并且您/您的管理层可以承担风险（但那时你会有 decission 并完成）

使用你已经做过firebase ACL 。要创建用户特定的depots，请使用每个用户节点（参见下文，此处不会呈现代码）。配置发生在控制台中。

Use the firebase ACL as you already did. To create user specific „depots" use per user nodes (see below, it won‘t render code here). The configuration happens in the console.

在服务器上构建业务逻辑并将所有凭据放在那里。这将确保您拥有完全控制权

Build business logic on a server and place all credentials there. This will ensure that you have full control

阻止读取明文数据的应用。使用公钥算法加密数据。将私钥保留在必须读取数据的系统上。然后，应用程序无法以简单的方式读取数据（但仍然可以查看您拥有多少以及更改率是多少）。这也不会阻止操纵或删除数据。

prevent the apps from reading the data in plaintext. Use public key algorithms to encrypt the data. Keep the private key on the systems that has to read the data. Then the app cannot read the data in plain (but still e.g. find out how much you have and what the rate of change is). This also will not prevent manipulation or deletion of data.

示例ACL：

// These rules grant access to a node matching the authenticated
// user's ID from the Firebase auth token
{
  "rules": {
"users": {
  "$uid": {
    ".read": "$uid === auth.uid",
    ".write": "$uid === auth.uid"
      }
    }
  }

这篇关于Android版Firebase实时（在线）数据库的安全性如何？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！