Android Question For what is SHA1 hash in manifest with google services

[Alessandra Pellegri]

Because I am trying to understand how google services work I am looking at this example:
https://www.b4x.com/android/forum/threads/google-maps-android-v2-tutorial.24415/#content

In this tutorial, in order to obtain the ApiKey I must send to Google the SHA1 hash of the signature of my app.

I would like to know how this SHA1 hash string is used and why it is needed.

Thank you

 

[KMatle]

Private sign your app (Tools -> Private Sign Key). In the Listbox you'll see the SHA1 Just copy and paste it...

 

[Erel]

The SHA1 signature ties Google Map key to the private sign key, so only you can use this specific Google Map key.

 

[Alessandra Pellegri]

But what prevents that someone takes the regular sign of my app, substitute it's own with mine and use my key ?
In other words:

What prevents App "C" from working ?
How could I protect me from this ?

 

[DonManfred]

The author of B is not able to sign the app and get it to work in C using your api-key as he does not have your sign-key.

 

[Alessandra Pellegri]

Ok, but the sign is a sequence of bytes. He can take this exact sequence and paste to its own app. It is not the right sign but how google can know this ? Is Android that checks if it is correct ?

 

[An Schi]

You have to use the identical signkey or google play won't allow you to upload the updated app.

 

[Alessandra Pellegri]

Ok, so if I correctly understand, SHA1 hash protect me from illegal redistributing of my APIKey but the robber can anyway use it for himself. Is it right ?

 

[Alessandra Pellegri]

Ok, so if I correctly understand, SHA1 hash protect me from illegal redistributing of my APIKey but the robber can anyway use it for himself. Is it right ?

Is it ?

Thank you

 

[Erel]

The Google Maps SDK can check the current APK signature and make sure that it matches the signature tied to the API key. It did enforce it in the past, I'm not sure that it still tests it as now the Google Maps free plan is unlimited anyway.

 

[Alessandra Pellegri]

OK, thank you