Is it bad practice to store keys in .properties file

Question

So i've just integrated with UrbanAirship for Android.

Their sample code uses a .properties file to store API keys and secrets. I found this quite alarming as these files are easily accessible after expanding an APK.

I'm not looking to start a debate about storing sensitive data in your app. I just want to know if it is unacceptable to store keys like this.

If so then which is a more secure but straight forward approach? I am currently storing my own API keys as static variables in a globals file.

Answer 1

Since APK contents are not encrypted, the string is just as easily extracted from a .properties file than from a compiled class. You can make it a little harder to extract by storing it encrypted inside your Globals class, but don’t expect anything you ship to users to remain a secret.