title: Simple hiding/obfuscation of strings in APK?
body: <p>Sometimes you need to store a password in the app itself, such as a username/password for communicating with your own server. In these cases it's not possible to follow the normal process of storing passwords - i.e. hash the password, store the hash, compare to hashed user input - because you don't have any user input to compare the hash to. The password needs to be provided by the app itself. So how to protect the stored password in the APK? Would a password-generating function like the one below be reasonably secure?</p>
  
  <p>Plain text:</p>
  
  <pre><code>String password = "$()&amp;HDI?=!";
  </code></pre>
  
  <p>Simple obfuscation:</p>
  
  <pre><code>private String getPassword(){
      String pool = "%&amp;/@$()7?=!656sd8KJ%&amp;HDI!!!G98y/&amp;%=?=*^%&amp;ft4%(";
      return pool.substring(4, 7) + pool.substring(20, 24) + pool.substring(8, 11);
  }
  </code></pre>
  
  <p>I know ProGuard has some obfuscation capabilities, but I'm curious about what the above "obfuscation" technique does when it's compiled, and how hard it would be for someone to figure it out by looking in the APK and/or using other more sophisticated techniques?</p>