Question

I’m a complete novice when it comes to SSL and security in general. I found the following example on how to load a keystore for trusting custom SSL certificates (this is using Apache HTTPClient, btw):

private SSLSocketFactory newSslSocketFactory() {
  try {
    KeyStore trusted = KeyStore.getInstance("BKS");
    InputStream in = context.getResources().openRawResource(R.raw.mystore);
    try {
      trusted.load(in, "ez24get".toCharArray());
    } finally {
      in.close();
    }
    return new SSLSocketFactory(trusted);
  } catch (Exception e) {
    throw new AssertionError(e);
  }
}

I guess you’d need access to the device in order to modify the keystore, but still… isn’t there a problem with the fact that the keystore password (“ez24get”) is readily available in the code? What would it take to compromise an application containing this code?

Answer 1

If it is a risk you are willing to take.

Anyone with enough determination to decompile your code could get it. Even if you obfuscate your code, you still run the risk since all they need to do is find the string.