Safe to enter a password in a mobile application.

Question

I have a web server that creates a QR code that is [username] + hash message md5 [username] [password]. Where [username] the user logged in at that time. Where [password] is the system password that I set and is common for the web server and applications.

The Android / iPhone / BlackBerry / Windows application scans this QR code and uses the [username] specified in the QR code for a hash with [password], which will tell me that the QR code came from my server.

Obviously, if someone got a [password], then they could create QR codes that did not come from my web server. Anyway, to safely store [password] in my application, or can someone decompile .apk and find it in .dex classes?

Answer 1

You can somehow confuse the password, but in the end it is only security through obscurity. Someone who wanted, of course, could reverse engineer it.

You probably want to see public key cryptography to avoid this - even if someone gains access to the public key, they still will not be able to use it to impersonate the server.

Answer 2

No.

If someone is motivated enough, they will be able to reverse engineer the password with a hard code.

Answer 3

I'm not sure about other platforms, but if you put your password hardcoded in plaintext on android, they will get it very easily. Other platforms may require more sophisticated methods. You can hash your password using a more advanced hashing algorithm so you don’t get the original password, but from what you said, you don’t want them to make “fake” QR codes.

The short answer is no, because everything can be hacked in some way if it is on the client side.