Search code examples
c#windowssecuritycredentialsservice-accounts

Compiling Service Account Credentials Into Executable?

I have a program (compiled into a DLL to be used in other applications) that uses a Google Service Account to create and upload some files to Google Drive. The credentials are stored in a credentials.json file. I want to be able to ship this program to clients but do not want to have these credentials readable to them as that presents an obvious security concern. What is the best way to go about compiling these credentials into the DLL so that they don't exist in plaintext anywhere accessible to the end user?

Solution

  • You could just hard code it in a string on your application: 

    var apiKey = "my key";

    But as mentioned in the comment above, someone can decompile the IL and see it. That would also make it difficult to change if you need to.

    Or, you could encrypt it in the configuration file.

    But in either of those options, or really any option where your application talks directly to the Google API, any savvy user can use something like Fiddler to inspect the traffic and see the key (even if it's over SSL).

    The only way to keep your Google API key safe is to not let your application talk directly to the Google API. You can setup your own API as a proxy. The user authenticates to your API using different credentials for each user, and your API talks to Google. That way, if anyone misbehaves, you know who it is and you can disable their credentials.