0

I want to hide the links to my server address in my Android app. When my app is decompiled, the links are clearly showing. Even with the proguard enabled I am not able to hide links. How can I protect these links?

  • 2
    Hiding links is bad idea. Protecting them with required authentication and authorization may help. – Cthulhu Sep 10 '15 at 7:30
5

This is a fool's errand. Even if you you could obfuscate them sufficiently in the source code, it would still be child's play to hook the device up to a proxy like Fiddler or Burp Suite, and see the raw URLs plain as day when the app is running. No need to look at your source code at all, and there is absolutely nothing you can do about protecting HTTP requests, and even HTTPS requests in this case, for several reasons.

So, was suggested in the comment, you need to protect the endpoints exposed by your server via authentication and authorization. Disguising the address is simply not a viable option.

  • Couldn't you configure an HTTP/HTTPS proxy to provide a public facing service and have it transmit the data to the real server securely via SOCKS5 or something similar? – Desthro Jun 10 '16 at 14:33
  • @Desthro that hides the physical server, but you still have the same problem that if the users have the public URLs, they can call it from outside the app. So, it makes the system more complex, but doesn't add any protection against this particular threat. – Xander Jun 10 '16 at 14:43
  • ah I was misunderstanding what the threat was. It just sounded like the OP was trying to obfuscate his/her personal server. – Desthro Jun 10 '16 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.