flutter - 将 Json 配置文件保存为 flutter 中的资产是否安全？

Question

I am working on an app, and I want to know what is the best way to store the config file. Now, I am planning to use a JSON file and save it as assets. However, the file is important，it should not be accessed by others.

Answer 1

I am an expert in CyberSecurity and I have some considerations to say. The first is that it is impossible for you to totally prevent an attacker from having access to sensitive information, all you can do is make it difficult, often to the point that it takes years to succeed, but there is nothing 100% safe from reverse engineering.

The second consideration is: There is only one way that will give the attacker data from the tray, and it can be considered the most vulnerable way to save sensitive data: Save to assets, in a json file. It seems ironic that you mention it.

Json is the most human-readable language that exists (and it is impossible to lose this position, read a file in quotes and its value with: it is intuitive even for those who do not program), if it is in the assets folder, it will be a file totally unprotected after compilation, which can be extracted without decompiling the apk, just using any file roller. This is practically saying: look and read my file, I'm begging you for it.

Sensitive data must be stored on the android on the keystore, and on iOS on the Keychain. There is a Flutter plugin that abstracts this for you ( https://pub.dev/packages/flutter_secure_storage ).

As a specialist in CyberSecurity, I need to tell you that even storing like this, you will not be 100% safe, in fact, security of this level does not exist. But what I recommend that will at least take some work and eliminate 99% of the people who are looking to break your app, is:

Convert json to String, and save it in encrypted FSS, without plain text. When you need the file, take the generated string, decrypt it, and turn it back into json. Remembering that the encryption key must also be stored, or if you are going to put it in your code, don't do it with plain text, encrypt it beforehand, or at least convert it to base64 (this is not security, it will only make literal searches difficult), and finally, don't use words like 'token', 'secure', 'secret' as a key, because those are the first words searched. Test something completely unusual, I used magnolia until one of these days (and I'm counting here because I changed).