Home/ Questions/Q 6843229
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T00:13:12+00:00

I have ‘secured’ the communication between my android application and a tls server providing

  • 0

I have ‘secured’ the communication between my android application and a tls server providing a financial transaction service, currently in development.

The security credentials are stored in a BKS keystore included in the Android apk. The password to the keystore is visible in plain text in the application source:


keyStore.load(is, "passwd".toCharArray());

I am concerned that if someone was to reverse engineer the app, they would be able to impersonate another user and compromise the security of the service.

I was wondering whether there is a fault in my implementation, if anyone else has this concern, and what the best method of securing against this possibility is.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I believe that Diffie-Hellman Key Exchange is what I was looking for. I’d rather not have to re-implement my own version of DH using a complicated process which involves the user.

    • 0