What is SHARED_SECRET ?

Question

1.) What is the purpose of the SHARED_SECRET variable in Headwind MDM?
2.) I noticed there is a default value for the SHARED_SECRET variable. Since I’m using the free version of Headwind MDM, is it possible to change this value, considering that others might also use the default and it could pose a security risk?

Answer 1

The shared secret (hardcoded in the mobile app and configured in the back-end) is used to sign the communication and avoid "man in the middle" attacks and unauthorized access to sensitive data.

You are completely right, it is recommended to change this value to avoid the security risk caused by using the default value.

To update the shared secret in the mobile app, get the source code, change the parameter REQUEST_SIGNATURE in app/build.gradle.

To apply settings, the mobile application needs to be rebuilt. You can build the app in Android studio or use the command

gradlew build

To update the shared secret in the back-end, edit the XML config file `/var/lib/tomcat9/conf/Catalina/localhost/ROOT.xml` and adjust the attribute hash_secret.

Both values of the shared secret must match.

Comments

okay so I can basically change the shared_secret even though I am using free headwind mdm ?

---

Headwind MDM Community is open source, so you can change anything including the shared secret.