3

Let us say that I have a Windows Phone application. If I hardcode a private key in the Windows Phone application, can people extract it once the application is released to the public on the Windows Store?

I am asking this because I have found no way of accessing installed certificates from the phone.

Improve this question
5
  • 3
    Yes, they can. – Adi Apr 29 '13 at 14:22
  • 1
    @Adnan would you at least write a proper and complete answer for how they are going to extract that private key? I know once the device is in the user's hand, they can practically take it apart bit by bit. But your comment doesn't add anything to this site's knowledge. – void_in Apr 29 '13 at 15:57
  • 2
    @void_in This is exactly what comments are for. I know that what I've written isn't a complete answer, so I didn't write it as an answer. Also, OP isn't interested in knowing how they can do it. He asked about the possibility of doing so. Now, let's think together, does your comment add anything to the site's knowledge? – Adi Apr 29 '13 at 16:06
  • "I am asking this because I have found no way of accessing installed certificates from the phone." Obviously the OP is asking the question because he didn't know any way of doing it. If someone can prove it to him that he is wrong in his assumption, that would be a constructive answer/comment. I won't respond on your last part. I guess there is an unwritten code of ethics that every professional should follow. – void_in Apr 29 '13 at 16:17
  • @JoeBorg This might be relevant: Reverse Engineering Windows 8 Apps. – Adi Apr 29 '13 at 19:09
5

With software, reverse engineering works (there is even a dedicated StackExchange site for reverse engineering questions). Extracting secrets from compiled binaries has been done and redone and done again since the days of the first "copy-protected" games for personal computers, back in the 1980s. The bottom-line is that you cannot really hide a secret value in an application.

What you can do is to hide a customer-specific secret in the application. This is similar to giving to each customer his own login+password, except that the human customer does not see it (it is hidden in the application). This won't prevent reverse-engineering, but it may help with mitigating consequences: if a given "application secret" appears to be leaking too much (e.g. hundreds of different clients use it), then you can invalidate that secret on the server, without impacting the rest of your user base. (I assume here that your private key, to be hidden in the application, is used to talk to a server that you control.)

This is somehow equivalent to the Blu-Ray security model: each (physical) player has a player-specific key, and content distributors can blacklist keys which are known to have been leaked through reverse-engineering (the actual blacklisting uses a nifty system called broadcast encryption because it needs to work even without a network; but a Windows phone is a phone, thus presumed network-able).

Improve this answer
2
  • +1 Did not know there was such a StackExchange site. – Steve Apr 29 '13 at 18:42
  • It is very recent. Got out of private beta one or two weeks ago, I think. – Tom Leek Apr 29 '13 at 18:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.