How do you feel about code obfuscation and what methods of code protection do you think are the most effective?

Positive. Obfuscation increases the complexity of reverse engineering, making it more difficult for malicious actors to analyze the code.

The most effective protection methods:

• Obfuscation: Obscuring code logic, renaming classes, methods, and fields. Tools like R8/ProGuard.
• Encryption: Encrypting sensitive data and critical parts of the code.
• Code integrity: Performing integrity checks during runtime to detect modifications.
• Hiding keys and secrets: Storing sensitive data securely, for example, using Android Keystore.
• Debugger protection: Detecting and countering attempts to connect a JDWP debugger.
• Root/jailbreak detection: Disabling functionality or exiting the app upon detecting a compromised device.

A comprehensive approach combining several methods provides the best protection.

Example of basic obfuscation using R8:

# Keep all classes that extend Activity
-keep public class * extends android.app.Activity

# Prevent optimization from removing annotations.
-keepattributes *Annotation*

# Keep all methods and fields on classes returned by this method.
-keepclassmembers class foo.bar.Baz {
  <fields>;
  <methods>;
}

# Explicitly remove the R.java file.
-dontwarn **R$*
-dontnote **R$*
-dontoptimize **R$*