title: What is the point of encrypting anything in Android (or Java) if source code can be reverse engineered?
body: <p>Android and Java provide a <a href="http://www.tutorials-android.com/learn/How_to_encrypt_and_decrypt_strings.rhtml" rel="noreferrer">crypto API</a> that is relatively easy to use for crypto non-experts.</p>
  
  <p>But since we know that no code can really be protected from reverse engineering, especially  string constants used as seeds or shared secrets, I am wondering: What is the point of going through the ordeal of encrypting and decrypting in Android applications?</p>
  
  <p>Am I missing something?</p>
  
  <p><strong>Trying to make my question clearer and more concrete:</strong> Suppose I have an application in which certain strings used <em>by</em> the code and <em>in</em> the code (i.e. <strong>not</strong> user data) need to be secret: One approach is to store them in encrypted form in the compiled <code>.apk</code> and decrypt them (using an obfuscated hard-coded password) at runtime. Another approach would be to store them in encrypted form in a remote server, fetch them (over the Internet) and decrypt (using a shared password) them at runtime.</p>
  
  <p>I don't see much difference between the two, since both require the "secret key" being present in the (reverse-engineer-able) code.</p>
  
  <p>Is there a solution to this problem?</p>
  
  <p>If there isn't a solution, why encrypt at all?</p>