Online SHA1 hash generator

In my Objective C code, I have a consumer key and secret hardcoded in my code to be used in SHA-1 encryption. What I would like to know is whether I could avoid hardcoding to improve security. I have found the following so far,

Finding 1https://www.owasp.org/index.php/Technical_Risks_of_Reverse_Engineering_and_Unauthorized_Code_Modification#Cryptographic_Key_ReplacementSteps explained are as follows,

1. Damage static keys that are declared in source code. Such keys should be damaged while on disk to prevent an adversary from analyzing and intercepting the original key;

2. Next, the application should repair the key just before the code requiring the key uses it;

3. Immediately before use of the key, the application should perform a checksum of the key’s value to verify that the non-damaged key matches the value that the code declares at build time; and

4. Finally, the application should immediately re-damage the key in memory after the application has finished using it for that particular call.

Finding 2https://github.com/UrbanApps/UAObfuscatedString

Can somebody help me please?

Sample code:

+ (NSString *) getOauthHeaderForRequestString:(NSString *)requestString {NSString *oauthConsumerKey = @"<consumer key which I want avoid hardcoding>";NSString *oauthConsumerSecret = @"<consumer secret which I want to avoid hardcoding>";NSString *oauthSignatureMethod = @"HMAC-SHA1";NSString *oauthVersion = @"1.0";NSString *oauthNonce = [self generateNonce];NSString *oauthtimestamp = [NSString stringWithFormat:@"%d", (int)[[NSDate date] timeIntervalSince1970]];NSArray * params = [NSArray arrayWithObjects:                    [NSString stringWithFormat:@"%@%%3D%@", @"oauth_consumer_key", oauthConsumerKey],                    [NSString stringWithFormat:@"%@%%3D%@", @"oauth_nonce", oauthNonce],                    [NSString stringWithFormat:@"%@%%3D%@", @"oauth_signature_method", oauthSignatureMethod],                    [NSString stringWithFormat:@"%@%%3D%@", @"oauth_timestamp", oauthtimestamp],                    [NSString stringWithFormat:@"%@%%3D%@", @"oauth_version", oauthVersion],                    [NSString stringWithFormat:@"%@%%3D%@", @"request", [requestString stringByAddingPercentEscapesUsingEncoding:NSUTF8StringEncoding]],                    nil];params = [params sortedArrayUsingSelector:@selector(compare:)];NSString *parameters = [params componentsJoinedByString:@"%26"];NSString *postURL = @"<my post url>";NSArray * baseComponents = [NSArray arrayWithObjects:                            @"POST",                            [self encodeString:postURL],                            parameters,                            nil];NSString * baseString = [baseComponents componentsJoinedByString:@"&"];NSArray *signingKeyComponents = [NSArray arrayWithObjects:oauthConsumerSecret, @"", nil];NSString *signingKey = [signingKeyComponents componentsJoinedByString:@"&"];NSData *signingKeyData = [signingKey dataUsingEncoding:NSUTF8StringEncoding];NSData *baseData = [baseString dataUsingEncoding:NSUTF8StringEncoding];uint8_t digest[20] = {0};CCHmac(kCCHmacAlgSHA1, signingKeyData.bytes, signingKeyData.length, baseData.bytes, baseData.length, digest);NSData *signatureData = [NSData dataWithBytes:digest length:20];NSString *oauthSignature = [self base64forData:signatureData];// final request buildNSString *oauthHeader = @"OAuth ";oauthHeader = [oauthHeader stringByAppendingFormat:@"oauth_consumer_key=\"%@\"",oauthConsumerKey];oauthHeader = [oauthHeader stringByAppendingFormat:@",oauth_nonce=\"%@\"",oauthNonce];oauthHeader = [oauthHeader stringByAppendingFormat:@",oauth_signature=\"%@\"",[self encodeString:oauthSignature]];oauthHeader = [oauthHeader stringByAppendingFormat:@",oauth_signature_method=\"%@\"",oauthSignatureMethod];oauthHeader = [oauthHeader stringByAppendingFormat:@",oauth_timestamp=\"%@\"",oauthtimestamp];oauthHeader = [oauthHeader stringByAppendingFormat:@",oauth_version=\"1.0\""];return oauthHeader;}

I have created a login page in PHP with sha1().My password is stored in the correct format in sha1().I have checked both encrypted passwords in script with the database once both are giving the same result but still, I'm not able to log in.

If I'm not using $pass = sha1($_POST['pass']); my code works fine but when i try to login with sha1 funciton it gives me Else result Invalid Username or Password

$username = strtoupper($_POST['user_name']);    $pass = sha1($_POST['pass']);    $pdoConn = new PDO('mysql:host='.DB_SERVER.';dbname='.DB.';',DB_USER,DB_PASSWORD);      $pdoConn -> setAttribute(PDO::ATTR_ERRMODE,PDO::ERRMODE_EXCEPTION);    $login = $pdoConn->prepare("SELECT id,bank_name FROM bank_api_user WHERE (user_name=:username AND binary password=:password)");    $login->bindParam("username",$username,PDO::PARAM_STR);    $login->bindParam("password",$pass,PDO::PARAM_STR);    $login->execute();    $count = $login->rowCount();    $data = $login->fetch(PDO::FETCH_OBJ);        if($count)            {                $_SESSION['User_login'] = $data->bank_name;                $_SESSION['BANK_ID'] = $data->id;                header('location:welcome.php');            }        else            {                $error = 'Invalid Username or Password';            }$conn->close(); 

I know this question has been asked by many and have been answered.

So, why am I asking this question again? Cuz I tried those solutions, and I did followed Google docs, followed tutorials and youtube. Still no luck.

Oright, this is what I did in my project.

Project: GoogleSignIn

dependencies {        classpath 'com.android.tools.build:gradle:2.2.0'        classpath 'com.google.gms:google-services:3.0.0'      }

Gradle (Module: app)

apply plugin: 'com.android.application'android {    signingConfigs {        config {            keyAlias 'alias'            keyPassword 'keypass'            storeFile file('/home/reoxey/path/to/jks')            storePassword 'storepass'        }    }    compileSdkVersion 25    buildToolsVersion "25.0.0"    defaultConfig {        applicationId "reoxey.com.googlesignin"        minSdkVersion 19        targetSdkVersion 25        versionCode 1        versionName "1.0"        testInstrumentationRunner "android.support.test.runner.AndroidJUnitRunner"    }    buildTypes {        release {            signingConfig signingConfigs.config        }    }}dependencies {    compile fileTree(include: ['*.jar'], dir: 'libs')    androidTestCompile('com.android.support.test.espresso:espresso-core:2.2.2', {        exclude group: 'com.android.support', module: 'support-annotations'    })    compile 'com.android.support:appcompat-v7:25.0.0'    compile 'com.android.support:design:25.0.0'    compile 'com.google.firebase:firebase-auth:9.8.0'    compile 'com.google.android.gms:play-services-auth:9.8.0'    testCompile 'junit:junit:4.12'}apply plugin: 'com.google.gms.google-services'

LoginActivity.java

gso = new GoogleSignInOptions.Builder(GoogleSignInOptions.DEFAULT_SIGN_IN)                .requestIdToken(getString(R.string.web_client_key))                .requestEmail()                .build();        mGoogleApiClient = new GoogleApiClient.Builder(this)                .enableAutoManage(this, this)                .addApi(Auth.GOOGLE_SIGN_IN_API, gso)                .build();        findViewById(R.id.sign_in_button).setOnClickListener(new OnClickListener() {            @Override            public void onClick(View view) {                Intent signInIntent = Auth.GoogleSignInApi.getSignInIntent(mGoogleApiClient);                startActivityForResult(signInIntent, RC_SIGN_IN);            }        });    }    @Override    protected void onActivityResult(int requestCode, int resultCode, Intent data) {        super.onActivityResult(requestCode, resultCode, data);        if (requestCode == RC_SIGN_IN){            GoogleSignInResult result = Auth.GoogleSignInApi.getSignInResultFromIntent(data);            if (result.isSuccess()){                Toast.makeText(getApplicationContext(),"Nailed it",Toast.LENGTH_LONG).show();            }else {                Snackbar.make(mLoginFormView,result.getStatus().toString(),Snackbar.LENGTH_LONG).show();                Toast.makeText(getApplicationContext(),"Messed",Toast.LENGTH_LONG).show();            }        }    }

string.xml

<string name="web_client_key">123456789-clientwebapplication.apps.googleusercontent.com</string>

There is no special configuration in manifest, and I believe that I am not missing anything there.

google-services.json

{  "project_info": {    "project_number": "{numeric-id}",    "firebase_url": "https://project--123456789.firebaseio.com",    "project_id": "project--123456789",    "storage_bucket": "project--123456789.appspot.com"  },  "client": [    {      "client_info": {        "mobilesdk_app_id": "1:{numeric-id}:android:sfdjgsdkdfgsfs",        "android_client_info": {          "package_name": "reoxey.com.googlesignin"        }      },      "oauth_client": [        {          "client_id": "{numeric-id}-androidkey.apps.googleusercontent.com",          "client_type": 1,          "android_info": {            "package_name": "reoxey.com.googlesignin",            "certificate_hash": "{sha1-from-jks-file}"          }        },        {          "client_id": "{numeric-id}-webapplication.apps.googleusercontent.com",          "client_type": 3        }      ],      "api_key": [        {          "current_key": "{android-key}"        }      ],      "services": {        "analytics_service": {          "status": 1        },        "appinvite_service": {          "status": 2,          "other_platform_oauth_client": [            {              "client_id": "{numeric-id}-webapplication.apps.googleusercontent.com",              "client_type": 3            }          ]        },        "ads_service": {          "status": 2        }      }    }  ],  "configuration_version": "1"}

Oright, now Firebase console.

• created project with package name
• added sha1 fingerprint generated from jks file
• enabled authentication for google signin

that's it I guess, hope I provided everything,
so what am I missing here.

When I click on google sign, it gives me an error with 12501 status code. I don't know what's wrong here. Anyone?

Thanks in Advance.

We are using the pdf.js (1.3.91) and pdf.worker.js. Our security ask me now, if I use the sha-1 algorithm in my or my third party code. But I cannot answer it. So my question here is:

Did PDF and so mozillas pdf.js ever used the SHA-1 algorithm (e.g. password hashing)?
If yes, did pdf.js removed it?
If yes, at what version?

In my android app i have a hashed string that i want to compare with a regular string from an edittext. I do that using the following

try {         MessageDigest hashDigester = MessageDigest.getInstance("SHA-1");    } catch (NoSuchAlgorithmException e) {        e.printStackTrace();    }return (new BigInteger(1, hashDigester.digest(pin.getBytes())).toString(16)).equals(object.getPin());

The above code works fine. Now i am tring to do the same in ios using swift 3.0I tried using CryptoSwift to create the hash from the edittext like this

text.sha1()

and i also tried using the below

extension Data {    func hexString() -> String {        let string = self.map{String(format:"%02x", Int($0))}.joined()        return string    }    func SHA1() -> Data {        var result = Data(count: Int(CC_SHA1_DIGEST_LENGTH))        _ = result.withUnsafeMutableBytes {resultPtr in            self.withUnsafeBytes {(bytes: UnsafePointer<UInt16>) in                CC_SHA1(bytes, CC_LONG(count), resultPtr)            }        }        return result    }}extension String {    func hexString() -> String {        return self.data(using: .utf8)!.hexString()    }    func SHA1() -> String {        return self.data(using: .utf8)!.SHA1().hexString()    }}

Both gave me the same result but not the same with my android code.Do you have any suggestions how should i adjust my swift code?