Tukukkk

We were planning to use Firebase Anonymous Authantication and Realtime Database for our Android app. Then we wanted to try if our Firebase Api Key can be used in another app to access our Database and we've crated a fake app with same package name, put our existing Firebase Api Key to it and then signed it with brand new Sign key. Once we run it, it was able to access our previous apps firebase backend.
(Since Firebase Api key can be extracted from apk easily, we wanted to simulate the same action)

Despite the most of the answers says that Firebase checks the signature of the App, we were able to access the database with completely different APK.

Do I missing anything on the Firebase configuration side ?

Edit :

What I Did Step By Step :

1) Created a new Android Project with same package name of existing one.

2) Put the google-services.json of existing project to new project

3) Wrote the following code to new project

final FirebaseAuth mAuth;

mAuth = FirebaseAuth.getInstance();

FirebaseUser currentUser = mAuth.getCurrentUser();



final String TAG = "AuthTest";

mAuth.signInAnonymously()

   .addOnCompleteListener(this, new OnCompleteListener<AuthResult>() {

    @Override

    public void onComplete(@NonNull Task<AuthResult> task) {

    if (task.isSuccessful()) {

        // Sign in success, update UI with the signed-in user's information

        Log.d(TAG, "signInAnonymously:success");

        FirebaseUser user = mAuth.getCurrentUser();

    } else {

        // If sign in fails, display a message to the user.

        Log.w(TAG, "signInAnonymously:failure", task.getException());





    }

}

});

4) Signed the APK with completely new Signing Key

5) Run the Application on the device.

Result : Anonymous user was created on our existing Firebase Project