• Latest
  • Trending
How Should API Keys be Stored?

How Should API Keys be Stored?

June 28, 2022
ATC Ghana supports Girls-In-ICT Program

ATC Ghana supports Girls-In-ICT Program

April 25, 2023
Vice President Dr. Bawumia inaugurates  ICT Hub

Vice President Dr. Bawumia inaugurates ICT Hub

April 2, 2023
Co-Creation Hub’s edtech accelerator puts $15M towards African startups

Co-Creation Hub’s edtech accelerator puts $15M towards African startups

February 20, 2023
Data Leak Hits Thousands of NHS Workers

Data Leak Hits Thousands of NHS Workers

February 20, 2023
EU Cybersecurity Agency Warns Against Chinese APTs

EU Cybersecurity Agency Warns Against Chinese APTs

February 20, 2023
How Your Storage System Will Still Be Viable in 5 Years’ Time?

How Your Storage System Will Still Be Viable in 5 Years’ Time?

February 20, 2023
The Broken Promises From Cybersecurity Vendors

Cloud Infrastructure Used By WIP26 For Espionage Attacks on Telcos

February 20, 2023
Instagram and Facebook to get paid-for verification

Instagram and Facebook to get paid-for verification

February 20, 2023
YouTube CEO Susan Wojcicki steps down after nine years

YouTube CEO Susan Wojcicki steps down after nine years

February 20, 2023
Inaugural AfCFTA Conference on Women and Youth in Trade

Inaugural AfCFTA Conference on Women and Youth in Trade

September 6, 2022
Instagram fined €405m over children’s data privacy

Instagram fined €405m over children’s data privacy

September 6, 2022
8 Most Common Causes of a Data Breach

5.7bn data entries found exposed on Chinese VPN

August 18, 2022
  • Consumer Watch
  • Kids Page
  • Directory
  • Events
  • Reviews
Friday, 22 September, 2023
  • Login
itechnewsonline.com
  • Home
  • Tech
  • Africa Tech
  • InfoSEC
  • Data Science
  • Data Storage
  • Business
  • Opinion
Subscription
Advertise
No Result
View All Result
itechnewsonline.com
No Result
View All Result

How Should API Keys be Stored?

by ITECHNEWS
June 28, 2022
in Leading Stories, Opinion
0 0
0
How Should API Keys be Stored?

Mobile app developers keep hearing that they shouldn’t store API keys in their app code but they don’t hear where they should store them. In this article we discuss the topic and provide some practical solutions.

API keys are unique digital identifiers that authenticate requests to the API from a remote client such as a mobile app and are typically used to control API access; they can also be used for identification, rate limiting and billing purposes. Unfortunately, API keys are often inadequately protected and can easily be exploited in a number of ways:

YOU MAY ALSO LIKE

ATC Ghana supports Girls-In-ICT Program

Vice President Dr. Bawumia inaugurates ICT Hub

  1. Mobile apps can be downloaded from app stores by anyone,reverse engineered and the keys extracted.
  2. API keys may be accidentally exposed through public code sharing sites such as GitHub.
  3. A Man-in-the-Middle attack can be performed to intercept the traffic between a mobile app and backend API and steal API keys and other secrets.

Risks of exposed API keys

Depending on the functionality of the API and the permissions associated with it, there are a number of risks to your business if your API key becomes available to bad actors:

  • Your app can be impersonated and API calls can be made on its behalf, resulting in potential fraudulent activity.
  • Bots or scripts can use your API key to rapidly hit rate limits through a DDoS attack on your app. In a pay-per-use model API, your paid quota could be consumed through unauthorised usage. Once these limits/quotas are reached your app may stop working.
  • User data may be extracted from your backend servers via the API.

Securing API Keys

To prevent accidentally exposing API keys to the public, it would obviously be best to avoid embedding them directly in the app’s source code. However, this is non-trivial to achieve because the mobile app needs to transmit the API key to the API backend. Here are some approaches which could be considered:

  • Code obfuscation is often used to prevent decompilation and reverse engineering of an app’s source code. While this will slow cybercriminals down and make it harder for them to extract the API keys and secrets, there are readily available tools, such as mobSF and Apktool, that enable attackers to get around most encryption techniques.
  • An external proxy service can be used but while your API key will be hidden from public view, the proxy itself is also vulnerable to attack.
  • Instead of solely relying on API keys, user authentication protocols such as OAuth2 can provide an additional security layer. However, this will not prevent app impersonation or credential stuffing attacks.
Source: David Stewart
Via: Security Boulevard
Tags: How Should API Keys be Stored?
ShareTweetShare
Plugin Install : Subscribe Push Notification need OneSignal plugin to be installed.

Search

No Result
View All Result

Recent News

ATC Ghana supports Girls-In-ICT Program

ATC Ghana supports Girls-In-ICT Program

April 25, 2023
Vice President Dr. Bawumia inaugurates  ICT Hub

Vice President Dr. Bawumia inaugurates ICT Hub

April 2, 2023
Co-Creation Hub’s edtech accelerator puts $15M towards African startups

Co-Creation Hub’s edtech accelerator puts $15M towards African startups

February 20, 2023

About What We Do

itechnewsonline.com

We bring you the best Premium Tech News.

Recent News With Image

ATC Ghana supports Girls-In-ICT Program

ATC Ghana supports Girls-In-ICT Program

April 25, 2023
Vice President Dr. Bawumia inaugurates  ICT Hub

Vice President Dr. Bawumia inaugurates ICT Hub

April 2, 2023

Recent News

  • ATC Ghana supports Girls-In-ICT Program April 25, 2023
  • Vice President Dr. Bawumia inaugurates ICT Hub April 2, 2023
  • Co-Creation Hub’s edtech accelerator puts $15M towards African startups February 20, 2023
  • Data Leak Hits Thousands of NHS Workers February 20, 2023
  • Home
  • InfoSec
  • Opinion
  • Africa Tech
  • Data Storage

© 2021-2022 iTechNewsOnline.Com - Powered by BackUPDataSystems

No Result
View All Result
  • Home
  • Tech
  • Africa Tech
  • InfoSEC
  • Data Science
  • Data Storage
  • Business
  • Opinion

© 2021-2022 iTechNewsOnline.Com - Powered by BackUPDataSystems

Welcome Back!

Login to your account below

Forgotten Password?

Retrieve your password

Please enter your username or email address to reset your password.

Log In
Go to mobile version