Hiding Secret Keys in Your Flutter App: Comprehensive Guide and Best Practices

[@ozayed5580]

You forgot to mention that we have to add .env to .yaml file as Assets, which is mentioned in the official documentation. but thanks for the video

[@Snehasis4321]

Yes, you are right, just skipped that part while editing.

[@realistic3]

Thanks

[@christianmarpert3844]

Hi, thks for your video! didnt know about that package so far. was just wondering, if that .env file will be shipped to the client, so it could be exploited via reverse engineering?

[@Snehasis4321]

It is hard but it is still possible to get the key,values using reverse engineering . We can use encryption and decryption techniques on the .env values to make them more secure and difficult to hack.

[@dazlingwiz]

Great video. Is it necessary to print in the init state?

[@Snehasis4321]

No not required , just use for testing.

[@dazlingwiz]

thought so.. thanks for the video@@Snehasis4321

[@mohammedsolyman3891]

thank you very much

[@juanamayaduarte8975]

But, it's still plain text storage. How could you deal with reverse engineering attacks?

[@Snehasis4321]

you can use encryption and decryption techniques to hide the keys. if hacker get the .env file will be difficult to find the exact keys.

[@somnathdas8922]

Hi Snehasis are you from kolkata? Can you make a tutorial of voice room, live stream with webrtc. If you will do than It will be really helpful for us.

[@Snehasis4321]

Ok i will do it.

[@somnathdas8922]

@@Snehasis4321 Snehasis, I know Flutter, React, and React Native but I don't know about Appwrite after going through your tutorial I realised It's the same as Firebase. And you explained everything perfectly.

[@Snehasis4321]

@@somnathdas8922 yes it is the same , you can also say an alternative of firebase.

[@chrislamont7529]

Sorry but this is not hiding anything from anyone.

[@Snehasis4321]

What problem are you facing?

[@Glitcheverywhere]

​@@Snehasis4321Did you do any research about this package before making this video? The env file located on assets comes with your built in apk which is easily accessible from app like apkeditor on.

[@Glitcheverywhere]

@@Snehasis4321 ​Do a proper resarch before creating content. The dotenv is not secure to store secrect keys. When you build apk The ".env" file come with android apk assets. So anyone can access or see the secret keys from the .env file with app like "ApkEditor"