Question

I need to provide some passwords, API keys and similar sensitive data in my code. What are best practices in that regard? Hard-coded? SQlite? Some cryptographic framework?

Answer 1

Like the others said, you can’t both secure an API key and use it in your app. However, you can do simple obfuscation relatively easy and if the payoff to the cracker is low then you may not get burned.

One simple technique is to break your API key into several sub-strings. Make sure you put them in your code in some random order. For instance, if your API key is 12345678901234567890 you might break it up into 5 sub-strings like this:

static char *part1 = "12345";  
static char *part5 = "7890";    
static char *part3 = "890123";  
static char *part2 = "67";  
static char *part4 = "456";

If you run /usr/bin/strings on the resulting binary then you should not see the API key in order. Instead you’ll see the API substrings in the order listed in your C file. With 5 substrings like this, that is 5*4*3*2*1=120 permutations. If you break it into 13 substrings you’re looking at over 6 billion permutations.

However, that won’t stop someone who knows what they’re doing from getting your API key if they want it. Eventually you’ll have to combine the strings together and pass it to one of your methods, at which point a cracker could use a debugger to set a breakpoint and inspect memory.