You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently, most hardcoded strings can be extracted from the release binary using a text editor or strings, objdump cmd utils.
We could use a simple encryption mechanism with a hardcoded key (or just XOR).
Or/And, as @igor-sirotin suggested, split the key into several pieces and combine them at runtime.
It would be nice to have a macro for this that can be reused for the tokens we inject into the CI at compile time.
Admittedly, this is a protection against an honest man, and the proper mechanism should be implemented later (asking proxy for an ephemeral key, or something inspired by Waku RLN).
Description
Currently, most hardcoded strings can be extracted from the release binary using a text editor or
strings
,objdump
cmd utils.We could use a simple encryption mechanism with a hardcoded key (or just XOR).
Or/And, as @igor-sirotin suggested, split the key into several pieces and combine them at runtime.
It would be nice to have a macro for this that can be reused for the tokens we inject into the CI at compile time.
Admittedly, this is a protection against an honest man, and the proper mechanism should be implemented later (asking proxy for an ephemeral key, or something inspired by Waku RLN).
Acceptance criteria
The binary doesn't contain any 3rd party secrets as plaintext
related ticket status-im/status-mobile#21807
The text was updated successfully, but these errors were encountered: