firebase / firebase/firebase-android-sdk
Migrate internal SHA-1 usage to stronger cryptographic algorithms
- Dominant language
- Java
- Stars
- 2.6k
- Forks
- 710
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 31
Description
### Background
During an independent penetration test, the assessment identified internal SHA-1 usage within the Firebase Android SDK. Based on our technical review, this implementation is limited to identifier generation and compatibility purposes. It is not used for authentication, password protection, encryption of sensitive information, digital signatures, or other security-sensitive functions, and therefore is not considered exploitable within our application's context.
### Request
As part of our regulatory remediation programme, we are required to establish a remediation plan for all identified third-party dependencies containing deprecated cryptographic algorithms.
We would appreciate it if the Firebase team could consider replacing or migrating internal SHA-1 usage to stronger cryptographic algorithms in future Firebase Android SDK releases, where technically feasible and without impacting backward compatibility.
If there is already a roadmap for this enhancement, or if there are recommended migration paths for application developers, we would appreciate any guidance.
Thank you for your continued efforts in maintaining and improving the Firebase Android SDK.
Contributor guide
Research direction
No files, tests, or entry points are named in the issue. Start by locating the Firebase Android SDK's internal SHA-1 usage, then review identifier-generation and compatibility constraints; the work is done when a technically feasible migration or remediation plan, including developer guidance, is established without breaking backward compatibility.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, firebase, java
- Domain
- mobile-dev, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100