How to store a secret API key in an application's binary?

user142019 picture user142019 · Apr 2, 2011 · Viewed 19.3k times · Source

I am creating a Twitter client for Mac OS X and I have a Consumer secret. It's to my understanding I should not share this secret key. The problem is that when I put it as a string literal into my application and use it, like this:

#define QQTwitterConsumerSecret @"MYSECRETYOUMAYNOTKNOW"

[[QQTwitterEngine alloc] initWithConsumerKey:QQTwitterConsumerKey consumerSecret:QQTwitterConsumerSecret];

It is in the data section of my application's binary. Hackers can read this, disassemble the application, etcetera.

Is there any safe way of storing the Consumer secret? Should I encrypt it?

Answer

Graham Christensen picture Graham Christensen · Apr 2, 2011

There is no real perfect solution. No matter what you do, someone dedicated to it will be able to steal it.

Even Twitter for iPhone/iPad/Android/mac/etc. has a secret key in there, they've likely just obscured it somehow.

For example, you could break it up into different files or strings, etc.

Note: Using a hex editor you can read ascii strings in a binary, which is the easiest way. By breaking it up into different pieces or using function calls to create the secret key usually works to make that process more difficult.