Three ways to use AI on Android
summary
MVP is a clipboard reply app that uses the Gini SDK to generate replies, but the initial hardcoded API key is stolen from the APK and drains credits. Moving the key to a remote endpoint still fails because attackers impersonate the client. Adding attestation with Firebase App Check / Play Integrity plus a proxy (Firebase Functions) keeps keys server‑side and blocks illegitimate calls; using Vertex AI for Firebase removes most plumbing and finally works. Recommendations: proxy, attestation, keystore, and usage limits.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:58AI reply generator app
- 7:37Hardcoded keys pitfall
- 10:45Remote API key fetching risks
- 14:16Securing AI with attestation
- 17:32Proxy server approach
- 24:19Vertex AI for Firebase
- 28:57Security best practices
- 30:46Q&A
related talks
35mBuilding Androidify: an AI-powered Android experience
19mProtecting Your Users in an Agentic World
30mGenAI on Android with Gemini Nano and Firebase
10mAI in your pocket: Building intelligent Android apps
48mAndroid + AI: Solving Problems Smartly
57mAI Applications Security Puzzle
41mGen AI for Android Developers
01h 19mFull Stack AI Features