Should I confuse the OAuth user secret stored in the Android app?

Question

My Android app contains the secret OAuth user secret for the Twitter API. At the moment, it is in the .properties file in plain text, so the APK requires a zero-force search.

Should I take steps to hide it (e.g. rot13 or save it in confusing Java code)? Or should I avoid this altogether, as this would create a false sense of security?

How do people usually share / keep OAuth secret in Android apps? How widespread is it that a secret is stolen and abused?

Answer 1

The real question is what the attacker gets from his theft ...

You must do everything possible to protect secrets, but in the end, a highly motivated hacker can always access him in the installed application. Thus, this is the meaning of secrecy and difficulty of extraction.

The value of client privacy represents the application. It does not give access to user data. However, since Twitter supports the automatic issuance of credentials to previously approved applications (logging in with Twitter), an attacker could potentially create a web application with your secret and steal user data using blind redirects.

The problem with the implementation of Twitter is that they do not ask the developer about the nature of the application. If they did, they would not give you a secret to start with and block anyone from creating a web application using your client credentials and steal data from users who have already approved it.

Obfuscation is one option, but weak. Transferring privacy to a web server acting as an API proxy is different, but it just transfers the problem to another place, because now your application must authenticate against the proxy. However, this template can be quite safe if you require users to access your site (which it can use via web submissions, Twitter to log in). Thus, someone who is trying to abuse your proxy server will need their users to open accounts on your service, which is not very attractive.

In short, continue and obfuscate it. It does not hurt. Consider using a proxy template. And perhaps let Twitter know that their security policies are not great.

Answer 2

I would definitely read this analysis by one of the OAuth authors, Eran Hammer-Lahav, who is quoting another article revealing the secret issues of OAuth Twitter .

My advice was to confuse the key so that it could not be extracted trivially, and you should be safe from chancellors and spammers.

Hammer-Lahava's view is that OAuth secrets should not be revoked and should only be used to collect statistics. I hope Twitter adheres to this advice.

Answer 3

The main point of 0Auth is that you do not store any valuable confidential information on the device - therefore, it is normal to store a secret on the device (much better than real user credentials). If the secrets of your device are stolen, the user can always revoke access without having to change their credentials.