Security hole? In broad terms, yes. Realistically though, these aren't nuclear launch codes we're talking about.
About the worst thing that could happen is that someone could take and use your app's keys to do something against Twitter's TOS that will end up getting the keys banned. No user data would be vulnerable since you're not distributing the user tokens (that would be much worse from a security standpoint). Since anyone can register an app in 2 seconds at no cost, the only reason to do that kind of impersonation would be specifically to besmirch the reputation of you or your app.
One thing you could do is leave them out of the source code but make it clear that user's compiling from source need to obtain their own keys and put them in the appropriate place, but leave them in the binary version that you distribute. Not 100% secure, but makes it that little bit harder that will deter a certain number of n'er-do-wells.
发布评论
评论（1）
安全漏洞？从广义上讲，是的。但实际上，这些不是我们谈论的核发射代码。
可能发生的最糟糕的事情是，有人可能会获取并使用您应用程序的密钥来执行违反 Twitter 服务条款的操作，最终导致密钥被禁止。由于您没有分发用户令牌，因此任何用户数据都不会受到攻击（从安全角度来看，这会更糟）。由于任何人都可以在 2 秒内免费注册一个应用程序，因此进行这种模仿的唯一原因就是专门为了玷污您或您的应用程序的声誉。
您可以做的一件事是将它们排除在源代码之外，但要明确用户从源代码进行编译需要获取自己的密钥并将它们放在适当的位置，但将它们保留在您分发的二进制版本中。不是 100% 安全，但会增加一点难度，从而阻止一定数量的不做好事的人。
Security hole? In broad terms, yes. Realistically though, these aren't nuclear launch codes we're talking about.
About the worst thing that could happen is that someone could take and use your app's keys to do something against Twitter's TOS that will end up getting the keys banned. No user data would be vulnerable since you're not distributing the user tokens (that would be much worse from a security standpoint). Since anyone can register an app in 2 seconds at no cost, the only reason to do that kind of impersonation would be specifically to besmirch the reputation of you or your app.
One thing you could do is leave them out of the source code but make it clear that user's compiling from source need to obtain their own keys and put them in the appropriate place, but leave them in the binary version that you distribute. Not 100% secure, but makes it that little bit harder that will deter a certain number of n'er-do-wells.