2

We develop Android applications and by mistake following strings were sent within custom Android project folder to several clients:

  • keyAlias
  • keyPassword
  • storePassword

The .keystore file itself was not published. The keystore was used to sign 1 app that is now on Google Play. What does this mean in terms of security? Do we have to create both new keystore and passwords and maybe re-publish the app that is on market?

Improve this question
2
  • 1
    Your leaked data is only relevant if somebody can get the keystore file. You may wish to ratchet up the security on that file (e.g., only exists on USB flash drives, each in separate safes in separate locations, with a "signing key ceremony" for publishing updates to the app).
    – CommonsWare
    Commented May 6, 2016 at 13:54
  • Why would you want it in two places? redundancy? I would say for safety's sake, put exactly half of the file in each safe (xor one against 1010... and the other against 0101...) and that way you need to compromise both locations to get the actual file.
    – Jeff Meden
    Commented May 6, 2016 at 13:57

1 Answer 1

Reset to default
1

As the exposure is only to a few customers, it may be that the risk is low. That said, I'd err on the side of caution and treat the private key as having been compromised. This means revoking the signing certificate and creating a new one. (Applications signed prior to revocation will continue to be valid.)

If you want to take a less cautious route, you can create new passwords for the key and keystore.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .