Hacker News Reader

Comment by hyperthreading | Hacker News Reader

Is there any way to hide keys from the extractions? I tried it before and ended up to find that users can do that if they really want to.

View on HN

I think we can't hide keys up to my knowledge!

But make sure you just switched firebase to production mode.

In my case, the firebase was in development mode and the data is available public!

https://yoginth.com/college-hack#mitigations

It’s not about keys or modes, it’s about the rules they didn’t set up. Everyone uses firebase like that. Those “keys” are required to allow you to connect to the correct firebase app, nothing more. You don’t get any direct special permission to do things on the database or storage. Here some more info about the rules: https://firebase.google.com/docs/database/security

Firebase keys give you access to the database, which can be public. You just have to setup rules for the database, usually so users have to be authenticated to view anything and can only read their own private info.

edit: just realized you may have just been asking about hiding keys in general. Sorry if this wasn't what you were asking about!

> Don’t put your API keys, Tokens and Secrets visible easily

I was just confused at this part because permission & rules are the solution as far as I know. Thanks for the reply though :) I'm prettry sure now that exposing keys are no problem.

I'm not a mobile dev, but aren't there utilities like KeyStore for this?

https://developer.android.com/training/articles/keystore.htm...

Well, the trick is that using a KeyStore ensures that the key doesn't leak into the application (but is only used for cryptographic operations in a trusted environment).

However, you would need the plain key to authenticate against the database so using this wouldn't work.

Gotcha, I see the problem now.

Read-only access through intermediate proxy that you control (but not to all data like here) + login required for more access (via intermediate proxy or direct).

No, but I think the idea is to create a web API that connects to the database instead of having the phone connect directly to it.

No, you can only obfuscate it but the correct way to do this is to limit the access scope of the access key.

No, you can just obfuscate it and make it painful to extract to potential reverse engineers.

Reply on news.ycombinator.com