[ Embed login details in APK file, different for each user (or other options?) ]
We've been asked to create a thin web client on Android for a company with an existing web site, existing users.
They want to send an mms to their users, giving each user their own download URL. This URL will point to an Android apk file that has been created specifically for that user - it will include that user's login, and password, to the website.
i.e. the APK file would have embedded login details.
This would be done in J2ME by storing info in the JDK file.
I can see a simlar question on How to update resources file in apk - but not fully answered.
So:
is there a way to store an "asset" in the apk file that will be a text file, and easily editable by unzipping, editing, rezipping the apk file? (looks like answer is no)
do you know of any similar problems, or have worked on similar apps?
is there advice on how best to accomplish this application? Any sort of embedding of customer info on an automated level would be of interest...
would the best option be to set the app to build with an Ant script, and have the client actually customize the source code and build a new app per user? (this has the con that the client gets the source code, which we'd rather not have)
I have scanned apk tagged questions and can't seem to find a solution to this.
Many thanks, Richard
Answer 1
If it absolutely has to be that way, consider distributing two APKs, one with the application and the other containing a file with the handset-specific information. Sign them both with the same key, arrange for them to share a UID and the application will be able to read the file as if it were its own.
The rest of this probably belongs in a comment and not this answer, but I see lots of problems with what you're being asked to do:
- The standard behavior for just about every other application out there is to ask for a login and password once when needed and then remember it.
- If the user changes his password on your customer's web site, he has to get a new APK for his device instead of just having to reauthenticate.
- Any changes to the application will require generation and installation of a new APK for each user.
- All it would take is some unwitting user sharing his unique APK with someone else and your whole security model goes right down the tubes.
- Less relevant, but still important: If your customer is able to reconstitute a plaintext password from what they have stored, I question their security scheme.
Answer 2
I guess you could put it into the apk (or replace a dummy file there) if you use the assets folder for it.
You can obtain the data by filename instead resource-id quite easy:
getResources().getAssets().open(fileName)
Regards, Oliver
