title: How to secure an SFTP password in an APK file
body: <p>I'm developing an Android app which has a service to upload images/files to a FTP server.</p>
  <p>To make that possible, the app on the device has to log in into the FTP server before sending data.</p>
  <p>And here comes my problem. The user does not need to / have to know about the FTP login data. Only the app itself. I have to store the login data in the Java class. But how should I secure the user and password?</p>
  <p>I could encrypt it or obfuscate it. But I think it would be possible for a hacker to read the password at the runtime when the &quot;setPassword(passwordString) methods is called by the JVM:</p>
  <pre><code>String passwordString = &quot;myPass&quot;;
  
  JSch ssh = new JSch();
  session = ssh.getSession(SFTP_USER, HOST_ADDRESS, 22);
  session.setPassword(passwordString);
  </code></pre>
  <p>So how could I store my credentials inside the <a href="https://en.wikipedia.org/wiki/APK_%28file_format%29" rel="nofollow noreferrer">APK</a> file and secure them? I don't want anyone to get access to my FTP server.</p>