Encryption String in Android

Question

I am doing an HTTP Post from Android like:

HttpPost httppost = new HttpPost("example.com/ex.php");

PHP receives the request does what it is supposed to and sends the response back to Android.

When I decrypt the APK I show the URL (example.com/ex.php) I want to encrypt this URL. I used Pro-Guard but not give me any benefit still I can see the URL.

Is there any way to encrypt this URL or there is a way to make certification on server side?

Huh? By the time the Android app. goes to use the URL it must be decrypted, right? If so, an hacker might download the app. to a desktop computer, run it in an emulator, and use one of many tools to see what URL is being visited. Seems pretty pointless.. — Andrew Thompson
– Andrew Thompson, Commented Jan 1, 2014 at 17:39
Just to clarify, you want to encrypt the URL as it lives in your object code, in order to prevent reverse engineers form discovering it. — President James K. Polk
– President James K. Polk, Commented Jan 1, 2014 at 17:39

Greg Ennis · Accepted Answer · 2014-01-01 17:39:45Z

1

Never put sensitive data in the URL of your request. Use SSL and store the sensitive information in headers or in the content.

Reasoning is:

If you encrypt the URL on the device, where would you store the encryption key? You are back to the same problem.

Even if you securely stored the URL or got it from somewhere externally, anyone on your network can see your network traffic plain as day.

That's what SSL is for - it will handle this better than we can.

answered Jan 1, 2014 at 17:39

Greg Ennis

15.5k2 gold badges73 silver badges77 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

ahmad zuhair Over a year ago

do you have any example how can I use ssl in server side (domain)?

Greg Ennis Over a year ago

Since you are using php here is a starting point php.net/manual/en/mysqli.ssl-set.php

ahmad zuhair Over a year ago

Does DexGuard enough to avoid reverse engineering to show string in apk?

Greg Ennis Over a year ago

You can't do it. Read my answer again. The best you could hope for us to prevent casual reverse engineering by a novice. But don't fool yourself, nothing is foolproof.

Community · Accepted Answer · 2017-05-23 10:32:20Z

0

Obfuscation (Proguard) will not help. You need to "encrypt" or hide it yourself.

This is similar to the question asked here:

hiding strings in Obfuscated code

edited May 23, 2017 at 10:32

CommunityBot

11 silver badge

answered Jan 1, 2014 at 17:43

Jim

10.3k1 gold badge29 silver badges37 bronze badges

Collectives™ on Stack Overflow

Encryption String in Android

2 Answers 2

4 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related