Keep it Secret, Keep it Safe
summary
Explains why Android treats the network as hostile and argues for TLS everywhere, describes Android 6.0 features that detect cleartext by inspecting for a TLS Client Hello via StrictMode and a manifest useCleartextTraffic switch that hard-fails non‑TLS, demonstrates how common bad fixes (empty TrustManager or HostnameVerifier hacks) break hostname and chain validation, and shows practical tooling: ProviderInstaller via Play Services and the network tester nogotofail (GitHub) to find real-world regressions.
AI-written summary · about
chapters (40)
- 0:00Introduction
- 0:25Agenda
- 0:58Why TLS
- 1:50Examples
- 2:43Thought Experiment
- 3:04Nuclear Approach
- 4:41TLS
- 6:00Using TLS
- 6:23Using SSL
- 6:55Sample Code
- 7:06Server
- 9:02Third Party Code
- 9:18Strict Mode Detection
- 10:57Clear Text Traffic
- 11:29Libraries
- 11:59Why block traffic
- 13:18My favorite part
- 13:28How do you know
- 13:43Overrides
- 14:15Why use TLS
- 14:48What is TLS
- 15:48Make sure youre talking to the person
- 16:14Dealing with legacy clients
- 17:13Checking for SSL v3
- 18:11Common advice
- 18:42Valid certificates
- 19:04How to verify the certificate
- 20:05What is the certificate
- 20:55How do you trust the certificate
- 23:13Security SSL training article
- 26:05Dont bind
- 27:17What are we doing
- 28:21Vulnerability Alert and Blocking
- 28:58NoGoToFail
- 31:00Questions
- 33:21Certificate Warnings
- 34:53Certificate Pinning
- 36:00Cyber Suites
- 37:49How to trust a server
- 38:45Strictmode vs TLS
related talks
34mDemystifying Android Security
37mPractical security for Android apps
29mSecuring Android Applications - The not so se…
46mA More Secure World for Android Apps
29mSecuring Your Android Network Calls, from 2009 to 2019
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security
28mSecure Development whit Android
47mSecuring Android Applications, The Right Way