Move key retrieval to Firebase

[epenet]

No description provided.

[epenet]

When I decompiled the app it still has the old values in it. So I am quite sure they deploy the new values using Firebase remote-config: https://firebase.google.com/docs/remote-config

A test to check this would be to install the official app on an android device without Google Play Services (e.g. a LineageOS custom ROM and not installing any GApps) and to see if the app gets the updated key or not (I suspect not: because Firebase depends on Google Play Services).

Afaik there is no method (yet) to eavesdrop on the Firebase/Google connection. Though you could try to check the contents of the local configuration SQLite database of the app.

@mfonville it is possible to intercept the firebase request using Fiddler (install Fiddler on a PC, and set the proxy on the phone wifi connection).
You then have to clear the application settings, and restart the application to force the application to retrieve the new keys.

We need to find a way to make that generic...

[epenet]

Adding this link for reference: https://danq.me/2018/08/07/android-emulator-https-intercept/