2

We've been asked to create a thin web client on Android for a company with an existing web site, existing users.

They want to send an mms to their users, giving each user their own download URL. This URL will point to an Android apk file that has been created specifically for that user - it will include that user's login, and password, to the website.

i.e. the APK file would have embedded login details.

This would be done in J2ME by storing info in the JDK file.

I can see a simlar question on How to update resources file in apk - but not fully answered.

So:

  1. is there a way to store an "asset" in the apk file that will be a text file, and easily editable by unzipping, editing, rezipping the apk file? (looks like answer is no)

  2. do you know of any similar problems, or have worked on similar apps?

  3. is there advice on how best to accomplish this application? Any sort of embedding of customer info on an automated level would be of interest...

  4. would the best option be to set the app to build with an Ant script, and have the client actually customize the source code and build a new app per user? (this has the con that the client gets the source code, which we'd rather not have)

I have scanned apk tagged questions and can't seem to find a solution to this.

Many thanks, Richard

Community
  • 1
  • 1
Richard Le Mesurier
  • 29,432
  • 22
  • 140
  • 255
  • 4
    This sounds dubious at best from a security perspective. MMS's can be intercepted. Passwords should be possible to change. Resources can be read: a lost device would compromise that user's password. Perhaps you should try to find out what they are trying to achieve: presumably, a hassle-free authentication process for their end users? What kind of threats do the logins protect against, at what value? – Pontus Gagge Jan 24 '11 at 14:35
  • ...and to add, dubious from a scalability perspective. You'd need to change resources and use the SDK toolchain to repack the apk's and sign them. This is both a security risk (having the private key on a web facing server? icky!) and a scalability risk (heavy duty zipping and signing activity). If the number of users is small enough, it's feasible, I grant you, but it seems like a lot of work and risk for a relatively little gain. – Pontus Gagge Jan 24 '11 at 15:17
  • Thanks, Pontus - this is what I've been saying to the client all along (there is a scalability problem, they would need their own private key, this is not secure etc). However, it remains their desired solution - despite the information being rather private and having value. (I can only try so hard, but if I want to get paid for the work, I have to deliver their product) – Richard Le Mesurier Jan 25 '11 at 06:55

2 Answers2

1

I guess you could put it into the apk (or replace a dummy file there) if you use the assets folder for it.

You can obtain the data by filename instead resource-id quite easy: getResources().getAssets().open(fileName)

Regards, Oliver

Oliver
  • 1,269
  • 13
  • 21
  • Thanks, Oliver, I hoped it would be something really simple that I'd just missed - of course all my googling was looking for info on "resources" and not assets. – Richard Le Mesurier Jan 25 '11 at 06:52
  • can I change this file without rebuilding whole app? I want to have APK file and txt used by app. Txt file needs to be changed without rebuilding app and installed on device within apk file. Can I achieve that? – Piotr Jun 27 '12 at 09:18
  • 1
    @Piotr: You don't need to rebuild the whole app, just modify the apk file contents on the fly for each user and sign it again with your key. Details of this are in already given in the questions link http://stackoverflow.com/a/4944708/586722 – Oliver Jul 08 '12 at 09:42
  • @Oliver what I want to do is allow user to prepare own app version with different txt files inside (for example change a text inside menu without turning on Eclipse,having Android SDK, spinning new build etc.). I guess that method you mentioned might be too complicated. Do you have any idea how to achieve that? Should I prepare configuration files loaded from SD card? – Piotr Jul 09 '12 at 10:13
  • @Piotr: you asked for inside-the-APK, and so I answered it. If you want outside-the-APK, then just do it. I really don't get what you are really asking for. It doesn't matter if you open and use an asset plain text file in the APK or some SD card text file outside the APK. If you are asking about how to change text inside a menu, please search your Android API documentation and stackoverflow. If you are asking how to structure or parse the text file, consider INI style (directly supported by JAVA), JSON (directly supported by Android), or whatever you think is reasonable. – Oliver Jul 18 '12 at 18:46
  • @Oliver: I was asking about best pattern to provide user ability to change some parts of applications - like texts or images. I guess "outside the APK" is the best solution here. – Piotr Jul 19 '12 at 09:39
1

If it absolutely has to be that way, consider distributing two APKs, one with the application and the other containing a file with the handset-specific information. Sign them both with the same key, arrange for them to share a UID and the application will be able to read the file as if it were its own.

The rest of this probably belongs in a comment and not this answer, but I see lots of problems with what you're being asked to do:

  • The standard behavior for just about every other application out there is to ask for a login and password once when needed and then remember it.
  • If the user changes his password on your customer's web site, he has to get a new APK for his device instead of just having to reauthenticate.
  • Any changes to the application will require generation and installation of a new APK for each user.
  • All it would take is some unwitting user sharing his unique APK with someone else and your whole security model goes right down the tubes.
  • Less relevant, but still important: If your customer is able to reconstitute a plaintext password from what they have stored, I question their security scheme.
Blrfl
  • 6,817
  • 1
  • 25
  • 25
  • Thanks, Birfl for the solution - Sharing info between apps is on my horizon for the very near future. Concerning your comments, see my reply to Pontus above - my previous work was all about very secure systems and this is not my preferred way of letting a client log in. – Richard Le Mesurier Jan 25 '11 at 06:56