• 131
• 255
• 14

Securing Your Private Key for your Android App

by bernt & torsten

Maintaining the security of your private key is of critical importance, both to you and to the user. If you allow someone to use your key, or if you leave your keystore and passwords in an unsecured location such that a third-party could find and use them, your authoring identity and the trust of the user are compromised.

If a third party should manage to take your key without your knowledge or permission, that person could sign and distribute applications that maliciously replace your authentic applications or corrupt them. Such a person could also sign and distribute applications under your identity that attack other applications or the system itself, or corrupt or steal user data.

Your reputation as a developer entity depends on your securing your private key properly, at all times, until the key is expired. Here are some tips for keeping your key secure:

• Select strong passwords for the keystore and key.
• When you generate your key with Keytool,  do not  supply the  -storepass  and  -keypass  options at the command line. If you do so, your passwords will be available in your shell history, which any user on your computer could access.
• Similarly, when signing your applications with Jarsigner,  do not  supply the  -storepass  and  -keypass  options at the command line.
• Do not give or lend anyone your private key, and do not let unauthorized persons know your keystore and key passwords.

In general, if you follow common-sense precautions when generating, using, and storing your key, it will remain secure.