API Authentication if being embedded in a client-side application? about gobrake HOT 1 CLOSED

A couple points:

• Exposing your ID and Key is not a huge issue. The worst an attacker can do is to send you a bunch of fake errors or nonexistent APM data such as routes. The JavaScript notifier has the same problem and it has never been a big deal

• This question is not really specific to gobrake since any binary suffers from the same issue

• This question is not really specific to golang since any language that can produce a binary suffers from the same issue

• I tried googling for C/C++ questions that ask the same. One of the answers on SO says this:

  • Secure the key
  • Secure the decryption algorithm.

  The problem with securing the decryption algorithm is that this project is open source and any algorithm we implement here will be visible for the attacker. Check the link since the answer mentions a few useful techniques:

  • Disguise your key as a string that would normally appear within the code
  • Hash some or all of the code or data segments on startup, and use that as the key.
  • Generate the key at run-time
  • Create the key by choosing bytes from other data.

Hope this is helpful.

from gobrake.