Databases
StackOverflow2013
Postsdbo
POIf I use SSLSocket in Android and hard code the passcode to the truststore in the source code is that insecure?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POIf I use SSLSocket in Android and hard code the passcode to the truststore in the source code is that insecure?
    primarykey
    data
    text
    <p>I am using java's SSLSocket to securely connect an android application to a server. The certificate is located in a truststore. But the passcode to the truststore seems to be required for the connection and so it is currently hardcoded into the device. I don't know much about PKI but that doesn't seem secure. I am bundling the truststore with the application in the raw resources folder. Is there a better approach to securely allow an application to connect to a server using TLS? I am very much new to TLS/SSL so I would appreciate any help or recommendations. </p> <p>Here is the client side of the code. </p> <pre><code> store = KeyStore.getInstance("BKS"); InputStream in = appcontext.getResources().openRawResource(R.raw.truststore); store.load(in, "PASSWORD".toCharArray()); TrustManagerFactory tmf = TrustManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()); tmf.init(store); sslcontext = SSLContext.getInstance("TLS"); sslcontext.init(null, tmf.getTrustManagers(), new SecureRandom()); SSLSocketFactory sslsocketfactory = sslcontext.getSocketFactory(); // connect to socket SSLSocket sslsocket = (SSLSocket) sslsocketfactory.createSocket( "192.168.1.16", 9999); </code></pre>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. This table or related slice is empty.
    1. USminhaz1
    plurals
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    3. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POIf I use SSLSocket in Android and hard code the passcode to the truststore in the source code is that insecure?
      1. This table or related slice is empty.
      1. VTUpMod
    1. COWhen you say "insecure", are you concerned about someone decrypting and reading your network communication, or are you worried about other programs (or individuals) impersonating your app?
      singulars
      1. POIf I use SSLSocket in Android and hard code the passcode to the truststore in the source code is that insecure?
      1. USconnor.brinton
    2. COI'm concerned about someone recompiling the application, retrieving the passcode and the truststore and using it to connect to my server. If it is possible then it kind of defeats the purpose of the TLS in the first place.
      singulars
      1. POIf I use SSLSocket in Android and hard code the passcode to the truststore in the source code is that insecure?
      1. USminhaz1
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload