android release, protecting data resources

Question

I'm releasing an android app through google play.

This is my first release & I wanted to check all security possibilities before.

My concern currently is that the app uses an api for data sourcing. currently the api address is hard coded in the source.

obviously the server which hosts the api has been secured, with the api only available on 80.

Is there any 'android conventions' to API sources, similar to how strings.xml is treated?

Answer 1

You can store encrypted strings wherever you require. The logic is that in order to decrypt these strings, you'll need a key. Wherever you end up storing the key becomes the weak link in this chain. If your app is reverse engineered and someone gets a hold of the key, your strings are no longer encrypted.