Is it safe to keep a hardcoded oAuth token on an app built solely for personal use?

Question

I've built an android app that is only ever going to be used by me. It's not deployed to the store or anything - I download it to my phone with HockeyApp.

However, this app has an oAuth token hardcoded in as a string, which can access my private repositories on Github. Is this a security risk? I really don't want to go about the whole process of implementing an oAuth flow to generate a token via some kind of sign-in, so I'd like to just leave it hardcoded.

I'm not exactly the CEO of Google, so it is incredibly unlikely that anyone will make a malicious attempt to steal such things from my phone, though I suppose the possibility does exist.

Answer 1

"Safe" is a relative term, and not very helpful in a security context. Whether or not it is "safe" depends on what it protects and how you use it. If the app controls the US nuclear arsenal and you frequently leave your phone unlocked on the counter of public bathrooms while visiting Iran, I would say it is terribly unsafe. If only accesses your own personal GitHub (which does not contain state/trade secrets or nuclear launch codes), then I would say it is reasonable.

Hard coding credentials in an app you don't share is as secure as your phone or personal computer is. From a phone-security perspective, someone who has full access to your phone will probably be able to retrieve the key just as easily out of the phones memory whether it came from an oAuth flow or source code.

On the plus side, the fact that it is hard coded means no one can attack the oAuth flow - one less security risk. However it is stored in plain text on your laptop (in the source code presumably) - one more security risk. Again, which is "better" depends on your circumstances and expected threats, but for a typical person that isn't being directly targeted by skilled hackers, it probably doesn't make much of a difference.