Secure place for sensitive information

Question

Secure place for sensitive information

nnovalbos 371

Hello, I would like to know which is the best place to locate the urls of my rest service, which I want to be protected against a possible decompilation. (if possible, in the common project)

Thanks.

0 comments

1 answer

Your answer

Answer 1

Anonymous

Hello,

Welcome to our Microsoft Q&A platform!

If you want to protected against a decompilation, you can try to Protecting Your Xamarin Apps with Dotfuscator.

If you want to store your sensitive information in the secure place, you can try to use Xamarin.Essentials: Secure Storage API.

Best Regards,

Leon Lu

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

nnovalbos 371 Reputation points

2021-12-01T15:23:54.27+00:00

Thanks for answering @Anonymous ,

I think that secure storage is not good for me, since I have to put the url of my api in clear text.

dotofuscator is not an option as it isn´t free

Is there a way to put this information into a text file that when compiled cannot be seen in a possible decompilation?

When I create a file and assign it as an embed resource, when generating the apk the file is in clear
Rob Caplan 6,127 Reputation points Microsoft Employee Moderator

2021-12-04T00:34:50.65+00:00

There is no place at the app level that you can hide information from the user. In theory (and possibly in practice) some devices can prevent the user from getting the unencrypted APK, but once the user has the APK itself the best you can do is to make it difficult via obfuscation.

For your url scenario, obfuscating the url in the source is not sufficient as anybody running your app can get the url it connects to from the network connection. Even if the connection itself is secure, you can't hide the url itself from the owner of the client and the client side of the connection. If I wanted to find the urls your app connects to I wouldn't try to extract the URL from the APK. I would run the app and monitor the traffic through my local firewall.

You will need to make sure the REST endpoint is secure on its own and doesn't rely on being unknown.

Share via

Secure place for sensitive information

1 answer

Your answer