How to store a secret API key in an application's binary?

后端 未结 4 469
青春惊慌失措
青春惊慌失措 2020-12-02 22:34

I am creating a Twitter client for Mac OS X and I have a Consumer secret. It\'s to my understanding I should not share this secret key. The problem is that

4条回答
  •  自闭症患者
    2020-12-02 23:07

    You should not use a secret api key in an application that does not run solely on your server.

    Even if it's perfectly hidden.. you can always snoop on the data going through the wire. And since it's your device you could even tamper with SSL (man in the middle with a certificate created by a custom CA which was added to the device's trusted CA list). Or you could hook into the SSL library to intercept the data before actually being encrypted.

提交回复
热议问题