如何在跨应用程序发送 Intent 数据时保护其安全
我正在研究我的 Android 应用程序的安全方面。
我想知道在将 Intent 数据和附加内容从一个应用程序发送到另一个应用程序时保护其安全的方法，以便除了这两个应用程序之外没有其他应用程序可以窥探它。
其中一种暴力方法是使用android的加密解密来编码意图数据，有没有更好的方法来实现相同的效果？
提前致谢。
I am working on the security aspects of my android application.
I would like to know about the ways to secure the Intent data and extras while sending it from one application to another so that no other application other than these two can snoop it.
One of the brute-force approaches would be to use android's encryption-decryption to encode intent data, is there a better way to achieve the same ??
Thanks in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
正如其他答案中所指出的，尽管您可以将意图发送到完全合格的活动，但没有什么可以阻止某人使用相同的包创建应用程序。
您可能想为此方案添加一个额外的安全步骤：
首先向远程活动发送“挑战”意图（例如，它应该使用共享密码加密您提供的随机字符串并将其发送回给您） ）。
如果第一个安全步骤没问题，您可以使用其完全限定的活动自由地将未加密的消息发送到此远程应用。
这是相当蹩脚的安全性，但也许足以满足您的需求。
请看看下面 CommonsWare 的评论。
更安全的方法可能是将您的活动编码为绑定服务，保持挑战步骤，但通过更私密的通信。
As pointed in the other answers, although you can send an intent to a fully qualified activity, nothing prevents someone from creating an application with the same package.
You might want to add an additional security step to this scheme:
First send a 'Challenge' intent to the remote activity (it should, for example, encrypt a random string you provided using a shared passphrase and send it back to you).
If that first security step is ok, you may freely send unencrypted messages to this remote app by using its fully qualified activity.
This is rather lame security, but perhaps it's sufficient for your needs.
Please take a look at CommonsWare's comment below.
A more secure way might be to code your activity as a Bound Service, keeping the Challenge step, but by means of more private communication.
我的猜测是，如果您使用显式意图，即指定意图发送到的类，那么没有其他类可以拦截该意图并查看其数据。
但是，如果您尝试将信息发送到的应用程序中的类名称发生更改，则此方法可能会失败。
My guess is that if you use an explicit intent, i.e. specifying the class to which the intent is to be sent to, then no other class can intercept that intent and look at its data.
This method however, may fail if the class name in the application that you're trying to send the information to changes.
如果意图指定目标，该目标是发送者应用程序包的一部分，那么其他应用程序将没有机会捕获它 - 它将被传递到预期的接收者。
另一方面，如果您将意图发送到另一个应用程序，则无法保证意图的接收者将获得您期望的实现：如果您将意图发送到 com.mycompany.security.SecureReceiver，而不是您的应用程序，使用给定的类描述安装另一个应用程序，然后您将向该应用程序发送您的意图。
此外，Android 是一个开放系统。如果有人编译了自己的应用程序框架，那么他就可以操纵 Intent 传递系统。
您想保护您的数据免受用户或恶意应用程序的侵害吗？
If an intent specifies the the target, which is part of the sender application's package, then other applications won't have the chance to capture it - it will be delivered to the intended receiver.
On the other hand, if you send an intent to another application, there is no guarantee that the receiver of the intent will have the implementation you expect: if you send your intent to com.mycompany.security.SecureReceiver, but instead of your application, another application is installed with the given class description, than you will send your intent to that application.
Also, Android is an open system. If someone compiles his own application framework, than he can manipulate the Intent delivery system.
Do you want to protect your data from the user, or from malicious applications?