保护 Android 应用程序的安全
我已经“保护”了我的 Android 应用程序和提供金融交易服务的 tls 服务器之间的通信，目前正在开发中。
安全凭证存储在 Android apk 中包含的 BKS 密钥库中。密钥库的密码在应用程序源中以纯文本形式可见：
keyStore.load(is, "passwd".toCharArray());
我担心，如果有人对应用程序进行逆向工程，他们将能够冒充其他用户并危及服务的安全性。
我想知道我的实施是否存在错误，是否有其他人有这种担忧，以及防止这种可能性的最佳方法是什么。
I have 'secured' the communication between my android application and a tls server providing a financial transaction service, currently in development.
The security credentials are stored in a BKS keystore included in the Android apk. The password to the keystore is visible in plain text in the application source:
keyStore.load(is, "passwd".toCharArray());
I am concerned that if someone was to reverse engineer the app, they would be able to impersonate another user and compromise the security of the service.
I was wondering whether there is a fault in my implementation, if anyone else has this concern, and what the best method of securing against this possibility is.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
每当您将安全数据存储在客户端上时，它都可能会受到逆向工程的影响。您可能会尝试在代码中掩盖它，但坚定的黑客无论如何都会发现它。因此，使其更安全的唯一方法就是不要在代码中公开密码。也许您可以在应用程序启动时询问用户一些 pin 码并使用它来解密密码？
Whenever you store security data on the client it can be compromised by reverse engineering. You may try to obscure it in the code but determined hacker will figure it anyway. So the only way to make it more secure is not to have the password openly in the code. May be you can just ask user for some pin code at the start of the application and use it to decrypt the password?
您的应用程序中存储的凭据是否对每个用户都是唯一的，即每个用户都会获得具有唯一凭据的自己的 apk？如果您只有一个具有相同凭据的 apk，那么这与没有安全性一样好。更糟糕的是，它给人一种虚假的安全感。
您（您的雇主）确实应该聘请安全专家从安全角度设计您的系统。
这就是我要做的：
但不要把我的话当成理所当然。如果涉及金融交易，您仍然需要安全专家。
Are credentials stored in your app unique per user, i.e. every user gets it own apk with unique credentials? If you only have one apk with same credentials then this is as good as no security. Even worse, it gives false feeling of security.
You (your employer) should really hire a security expert to design your system from security point of view.
Here's what I'd do:
But don't take my word for granted. You still need a security expert if there are financial transactions involved.
我相信 Diffie-Hellman Key Exchange 正是我所寻找的。我不想使用涉及用户的复杂过程来重新实现我自己的 DH 版本。
I believe that Diffie-Hellman Key Exchange is what I was looking for. I'd rather not have to re-implement my own version of DH using a complicated process which involves the user.
目前正在为一家处理公司进行编程 -
它们是交易应用程序的一套规则和规定 - 或者 - POS APP（销售点应用程序），
规则在线列出为 PCI 验证，必须发行一定量的安全性或这将是 Visa,inc 或许多其他公司的诉讼。
关于您的问题，它不符合 PCI 合规性，因为这是一个安全问题。
请阅读 PCI 合规性，以便完全了解安全性，损害持卡人数据是不好的。
:)
currently programming for a Processing company-
their are a set of rules and regulations for a transaction application -OR- a POS APP(Point Of Sale application)
the rules are listed online as PCI validation, a certain amount of security has to be issued or it will be a law suit from Visa,inc or Many other Company's.
about your Question, it doesn't follow PCI compliance as that is a security issue.
please read the PCI compliance so that their is a complete understanding of Security, its not good to compromise Cardholder Data.
:)