Guardsquare Jan 16, 2023

Balancing Performance and Security with Android Baseline Profiles and DexGuard

M7 Related OWASP risk: Insufficient Binary Protections Learn more →

Article Summary

Here's a performance optimization problem most Android teams don't see coming: your security tooling might be silently breaking your baseline profiles. Guardsquare just solved it.

Android Baseline Profiles can improve app startup times by up to 40% (Google Maps proved this), but there's a catch. Most security tools that obfuscate method names inadvertently break these performance optimizations because the profile rules reference the original, now-changed method names.

Key Takeaways

Critical Insight

DexGuard 9.4 is the first security tool to seamlessly preserve Android Baseline Profile optimizations while obfuscating code, eliminating the traditional performance vs. security tradeoff.

The article reveals why some security tools completely nullify your performance work, and what makes DexGuard's approach fundamentally different.

About This Article

Problem

Android developers face a difficult choice. Security obfuscation tools typically break the method name rules that baseline profiles need for ahead-of-time compilation gains. This means developers can't easily have both security and performance.

Solution

DexGuard 9.4 from Guardsquare automatically updates baseline profile rules to work with obfuscated method names. This keeps the performance benefits intact while applying security transformations that R8 doesn't offer.

Impact

Developers can now ship apps with both the 40% startup time improvements from baseline profiles and strong security hardening. They no longer have to choose between performance optimization and code protection.