Background
During an independent penetration test, the assessment identified internal SHA-1 usage within the Firebase Android SDK. Based on our technical review, this implementation is limited to identifier generation and compatibility purposes. It is not used for authentication, password protection, encryption of sensitive information, digital signatures, or other security-sensitive functions, and therefore is not considered exploitable within our application's context.
Request
As part of our regulatory remediation programme, we are required to establish a remediation plan for all identified third-party dependencies containing deprecated cryptographic algorithms.
We would appreciate it if the Firebase team could consider replacing or migrating internal SHA-1 usage to stronger cryptographic algorithms in future Firebase Android SDK releases, where technically feasible and without impacting backward compatibility.
If there is already a roadmap for this enhancement, or if there are recommended migration paths for application developers, we would appreciate any guidance.
Thank you for your continued efforts in maintaining and improving the Firebase Android SDK.
Background
During an independent penetration test, the assessment identified internal SHA-1 usage within the Firebase Android SDK. Based on our technical review, this implementation is limited to identifier generation and compatibility purposes. It is not used for authentication, password protection, encryption of sensitive information, digital signatures, or other security-sensitive functions, and therefore is not considered exploitable within our application's context.
Request
As part of our regulatory remediation programme, we are required to establish a remediation plan for all identified third-party dependencies containing deprecated cryptographic algorithms.
We would appreciate it if the Firebase team could consider replacing or migrating internal SHA-1 usage to stronger cryptographic algorithms in future Firebase Android SDK releases, where technically feasible and without impacting backward compatibility.
If there is already a roadmap for this enhancement, or if there are recommended migration paths for application developers, we would appreciate any guidance.
Thank you for your continued efforts in maintaining and improving the Firebase Android SDK.