|
I see code, so what is, or isn't, working for you?
"One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
|
|
|
|
|
Since android code is visible for attackers, I want to change the name of variables and functions
I know there are some tools for android obfuscation but I want to add more security
I think I should have an excel file with 2 columns (1 - unique old names 2 - unique new names)
Then utilizing a tool replace the old names with the new ones
Any suggestion?
|
|
|
|
|
Replacing meaningful names by something else makes code not more secure. It makes it just a little bit harder to reproduce what the code is doing.
Recommended read: Security through obscurity - Wikipedia[^] and other sources about that term.
If you really want to do it:
Because source code files are text files, it is a job for simple search & replace which can be automated using regular expressions iterating over the values of an input file (CSV would be better / simpler to use than Excel) and a list of source files. With Linux I would use a shell script for all the stuff except the replace which can be done with sed.
|
|
|
|
|
|
The tools are provided by the console (PowerShell with Windows, bash with Linux). They are able to iterate over files in a directory (with an optional search mask and optionally including sub directories). You can even read column separated text files there line by line and use that data to perform the replacement (executing sed with Linux or again PowerShell commands with Windows).
|
|
|
|
|
|
AndroidVH wrote: Then utilizing a tool replace the old names with the new ones
Android Studio already does this:
Refactor --> Rename
"One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
|
|
|
|
|
i have an array list
lsCategory = new ArrayList<>();
lsCategory.add(new category("fffff","sssssss","ssssddd",R.drawable.thump));
lsCategory.add(new category("ddd","sssssss","ssssddd",R.drawable.thump));
i need to add more elements after my api call responce
public void onResponse(JSONObject response) {
try {
JSONArray jsonArray = response.getJSONArray("employees");
for (int i = 0; i < jsonArray.length();i ++)
{
JSONObject employee = jsonArray.getJSONObject(i);
Integer id = employee.getInt("id");
String title = employee.getString("first_name");
Object item = new category("tttt","dynamic","ssssddd",R.drawable.thump);
lsCategory.add((category) item);
}
} catch (JSONException e) {
e.printStackTrace();
}
}
But the item inside the response code not adding in to array list ( lsCategory ) only getting 2 elements which add in top , any solution guys?
|
|
|
|
|
Are you certain that the code inside that loop is actually gone through? Try adding some logging code to see what is happening.
|
|
|
|
|
Yes , it is looping , i just added a toast inside the loop and it is showing
|
|
|
|
|
Check the return value from the call to add. Or there is something else happening that we cannot see.
|
|
|
|
|
rathilesh c wrote: ...only getting 2 elements...
1) How are you verifying this?
2) What do you see if you add the following:
lsCategory.add((category) item);
Log.d(TAG, "Size = " + lsCategory.size());
3) Is an exception being thrown?
"One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
|
|
|
|
|
I'm newbie to Android and PHP but I've decided to make a professional e-commerce application
The php code is responsible to upload images and json files to the server
Users download and upload from the server
I've been electronic project manager for some years and I somewhat know how to do a project
I somewhat know what is DFMEA, automatic validation, documentation, risk management , ...
But since I'm new to this type of project, I'm always afraid of being confronted by something in the darkness while perhaps that thing is a very preliminary issue for even begginers
hence, I need your help
Even if this is a very very general question and normally is not a norm in forums, I hope you help me
If you have something in mind which may be helpful, please mention
It could be any type of information if you think it may be neglected even if it is very simple issue
For example, recently I understand something about passwords of the users:
It should not be stored in the database and something like MD5 should be used and the password should be salted and then the values be stored
Thanks in advance
|
|
|
|
|
AndroidVH wrote: I'm newbie to Android and PHP but I've decided to make a professional e-commerce application
The first question I would ask is why you think Android is going to be useful here? PHP is fine for e-commerce, as you want to run it on a web server. Where do you think Android will fit into the project?
|
|
|
|
|
I got your point, you mean just a mobile responsive website design is enough?
In fact to be honest I just saw many different applications which were designed for such a case
Now that you're asking this question I have to think and find out the benefits of the app 
I read this nice article:
Mobile Website vs. Mobile App (Application) – Which is Best for Your Organization? | Human Service Solutions[^]
When I utilize app cause:
1 - I can be able not to ask customers to type a special address and go to my site
2 - I need camera to take a photo and upload it as a product
3 - I think app is better than website from popeganda point of view (It is more attractive)
4 - I can send advertising pop up's to special customers
5 - ...
|
|
|
|
|
Yes, you can do all those things. However, the e-commerce service must run on a website so your users can get access to it. That means it needs to be accessible via internet browsers. Creating an Android app to give the same service is a separate project. So you need one team to build the website, and another team to create the Android app, and most likely one for iOS.
|
|
|
|
|
Yes, I have plan for both but for now I have concentrated on the app which needs a server
I thank you for your point (I did something but I didn't know why and now I know)
Would you please continue if there are some other points?
|
|
|
|
|
Probably best to concentrate on the server first. You cannot test the app until you have at least some functionality on the server. And, of course, you can test the server features easily with any (preferably all) browsers.
If you have specific problems then just open a question in the appropriate forum, and people will try to help.
|
|
|
|
|
|
I have a domain address and host
I don't want to have a site and I just want to have a server to put some data there
There are
1 - public-html folder where the index of a site could be placed in
2 - non public-html folder where the important files from security point of view are placed in
I put the data in non public-html
In public-html, I just put a php file called file1 which includes another php file called file2 which is placed in non public-html
file2 is responsible for uploads of the data to the non public-html and also some images and json files in public-html folder
But I don't want to have any index file that a site needs
Regarding security issues on server, what are the vulnerabilities of utilizing this type of file system instead of SQLite?
Do I use SQLite or I use encrypted json files in non public-html place of the server?
In other words, can I forget SQlite and use this type of file system management or it is dangerous or unsafe compared to SQLite for any reason ?
Example:
Imagine I want to register username and passwords of some users
User name is phone number of the user
I can create the following folders to register or retrieve the username and password of the users quickly:
1 - folder of international code
2 - folder of the first 3 digit
3 - folder of the next 2 digit
4 - the json file which the phone number is registered there
for example if the phone number is +518203040, we have the following folders:
1 - 51
2 - 820
3 - 30
4 - file1.json which the phone number is registered in
for encryption I totally make a different and vague json file which is not readable except that you have the key for decryption
Thanks in advance
|
|
|
|
|
First point, do not use encryption for passwords, it is potentially insecure. Use proper hashing as described in Secure Password Authentication Explained Simply[^]. If you do it properly then you can store it in SQLite, or any other type of database.
|
|
|
|
|
Thank for the article
I read the article but I still don't get from security point of view why a hash and salt should be created and saved beside password
It seems in this way we can ask user to enter any letter of interest as article specifies
From security point of view it seems useless
I mean an attacker just attempts to send username and password just like the original user who has forgotten his/her password
Can you please explain that for me?
|
|
|
|
|
You do not save the hash beside the password. The key to password security is that you never store passwords, either in clear text or encrypted. Both types can be hacked. You create a hash from a salt value and the password, and store the hash value in the database. When someone enters their password to login you recreate the hash from the entered password and saved salt value and compare with the stored hash. Hash values cannot (in general) be used to recreate the original data so are the most secure types for security.
|
|
|
|
|
Ok thanks, I got the point
In fact, It is not for protecting the database against brute force attack but It is protecting some other attacks
If somehow attacker reaches to the database, he/she can't access the passwords
I'm too worried about attacks, can I trust the server administrator for not deleting or editing a file from the server ?
|
|
|
|
|
AndroidVH wrote: can I trust the server administrator
We could not possibly answer that. You need to check what service they are providing, and what guarantees they make.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
