What is the best way to hide the keystore password in Android?
I'm new to Android development and implementing SSLSockets.  After doing some digging I was able to setup a simple server/client that is working.  The implementation I feel could use some work and stumped on how to load in the password to the keystore without having it in plain text.  Here is some code that is on the client side.  As you can see I have the password hard coded into a local var.  Is there a better way to load in the keystore password so I do not have it in plain text in the code?


        char [] KSPASS = "password".toCharArray();
		char [] KEYPASS = "password".toCharArray();
		try {
			final KeyStore keyStore = KeyStore.getInstance("BKS");
			keyStore.load(context.getResources().openRawResource(R.raw.serverkeys), KSPASS);
			
			final KeyManagerFactory keyManager = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
			keyManager.init(keyStore, KEYPASS);
			
			final TrustManagerFactory trustFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
			trustFactory.init(keyStore);
			
			sslContext = SSLContext.getInstance("TLS");
			sslContext.init(keyManager.getKeyManagers(), trustFactory.getTrustManagers(), null);
			Arrays.fill(KSPASS, ' ');
		    Arrays.fill(KEYPASS, ' ');
		
		    KSPASS = null;
		    KEYPASS = null;

 
What is the best way to hide the keystore password in Android?
===

I'm new to Android development and implementing SSLSockets.  After doing some digging I was able to setup a simple server/client that is working.  The implementation I feel could use some work and stumped on how to load in the password to the keystore without having it in plain text.  Here is some code that is on the client side.  As you can see I have the password hard coded into a local var.  Is there a better way to load in the keystore password so I do not have it in plain text in the code?


        char [] KSPASS = "password".toCharArray();
		char [] KEYPASS = "password".toCharArray();
		try {
			final KeyStore keyStore = KeyStore.getInstance("BKS");
			keyStore.load(context.getResources().openRawResource(R.raw.serverkeys), KSPASS);
			
			final KeyManagerFactory keyManager = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
			keyManager.init(keyStore, KEYPASS);
			
			final TrustManagerFactory trustFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
			trustFactory.init(keyStore);
			
			sslContext = SSLContext.getInstance("TLS");
			sslContext.init(keyManager.getKeyManagers(), trustFactory.getTrustManagers(), null);
			Arrays.fill(KSPASS, ' ');
		    Arrays.fill(KEYPASS, ' ');
		
		    KSPASS = null;
		    KEYPASS = null;

 