how/where to keep a private JSON file and bundle it in my app?

Question

Basically what I'm trying to do is to keep a JSON file in the app directory in Android Studio like what firebase does for the 'google-service.json' and bundle it with the APK directly.

I should be able to read this file in the app and also the file should be private.

Any help would be appreciated...

Use assets? No files in the APK are actually private. You can encrypt the APK, but if anyone cracks that, it's still readable — OneCricketeer, Jul 01 '18 at 14:32
the `root` directory that the apps uses `data\data\package.name`. — Joel Raju, Jul 01 '18 at 14:37
Based on @cricket_007 comment, no data will actually be private as it can be accessed hacking (rooting) the device. — Facundo Larrosa, Jul 01 '18 at 14:39
@facundo You don't need to root a device to download an APK off the Play store last time I checked — OneCricketeer, Jul 01 '18 at 14:42
@cricket_007 not download an APK, but to access application private data stored on device as Joel suggested to store in data\data\package.name — Facundo Larrosa, Jul 01 '18 at 14:43
`data\data\packagename` directory can be accessible via a thousands of File Manager apps. And you can only access data directory after app is installed so that json must to be somewhere already. If you pre bundle the file with apk chances are less but its not private . Reverse engineering can take it out. — ADM, Jul 01 '18 at 15:05

Arseny Levin · Answer 1 · 2018-07-01T15:18:06.803

You can store it encrypted in your assets folder to make it bundled along with the APK. How to create assets folder (right click on app):

How to read file from assets folder: read file from assets

If you want to make it private, the best you can do is upon launching the app, fetch a decryption key from a remote server. But in the bottom line - any embedded private data from your APK can be reversed and obtained. You can only make it harder and thus weed out the script kiddies.

I highly recommend consulting about your initial design with someone who has significant security experience. A good expert will propose a method where you eliminate most risks by design, rather than work really hard on securing something that shouldn't be there in the first place.

how/where to keep a private JSON file and bundle it in my app?

1 Answers1