把你的用户名和密码放在客户端android应用里安全吗

Question

so I'm developing an application in android studio using Java. I'm using this service on my client application that needs my username and password.

private Rsms s= new Rsms("Username","Password");

but I don't feel it's safe to just put my username and password in the code.

Answer 1

Your feeling is right. It is not recommended to store your password in source code. Instead you can store it maybe in protected section . You could use EncryptedSharedPreferences from the Jetpack security library like this :

  String masterKeyAlias = MasterKeys.getOrCreate(MasterKeys.AES256_GCM_SPEC);

  SharedPreferences sharedPreferences = EncryptedSharedPreferences.create(
      "secret_shared_prefs",
      masterKeyAlias,
      context,
      EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
      EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
  );

  // use the shared preferences and editor as you normally would
  SharedPreferences.Editor editor = sharedPreferences.edit();

As already discussed in many threads, there is no "really secure" solution in Android. It is better if the user authenticates his password on the server. If it is a developer web service, then in most cases you have an API that you can use. Then you can work with access tokens .

Answer 2

Try to save it with encryptedSharedPrefrences: https://github.com/behnamnasehi/EncryptedSharedPreferences