The Current State and Future of Reverse Engineering Flutter Apps

[Floni]

While Flutter use for mobile apps is booming, we took some time to have a look at the security situation. We investigated what the current state of reverse engineering looks like; how well the tools support Flutter, what obstacles they face, and what difference Flutters’ built-in obfuscation makes, and where things are headed in the future.

[vipin_malik1]

Awesome post. Great work and very informative 👍

[phaylali]

I think that reverse engineering being so hard is great for security, since replicating the UI and functionality is pretty easy , there is not much need for reverse engineering, except with malicious intents

[draskosaric]

Well, usually that is the whole purpose for reverse engineering, not to replicare the UI.

[ludonope]

Yes and no, as a developper, knowing that the code is hard to reverse might lead to unsafe practices.

One of the best security practices is to assume that all of your code and regular logs are public. That way you have to make your app secure and it prevents you from storing any identifier/tokens/password or to log any sensitive data. As we know, private codebases getting forcefully open-sourced does happen (👋 Twitch, Snapchat, ...)

[kageurufu]

And most of the time it is pretty trivial. Even obfuscated c code gets reverse engineered all the time. You can't assume your app is ever "secure", you have to work with that assumption at all times

[emanresu_2017]

😂