Home/ Questions/Q 6200505
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-24T04:22:53+00:00

I have a web server that creates a QR code which is [username] +

  • 0

I have a web server that creates a QR code which is [username] + a md5 hash of [username][password].
Where [username] is the user logged in at the time.
Where [password] is a system password set by me and common to web server and the apps.

My Android/iPhone/BlackBerry/Windows app will scan this QR code and use the [username] provided in the QR code to hash with [password] which will tell me that the QR code came from my server.

Obviously if someone were to get hold of [password] then they could create QR codes that did not come from my web server. So is there anyway to safely store [password] in my app or could someone decompile the .apk and find it in classes.dex?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You can obfuscate the password somehow, but ultimately this is only security through obscurity. Someone who wanted to could certainly reverse engineer it.

    You probably want to look at public key cryptography to avoid this – even if someone gets access to the public key, they still won’t be able to use it to impersonate your server.

    • 0