Sign here please!
summary
Explains that app identity hinges on APK signatures not package names and shows concrete failures: lost keystore blocks updates, debug keystore password is well known, certificate pinning breaks when a client rotates certs, and Google offers Google Play app signing with an upload key that can be revoked. Demos and tools cited: zipalign and apksigner, certificate chains and Let's Encrypt, HSMs with multi‑person tokens and hardware security module storage, validity >=25 years, API fragmentation (latest API on ~1.1% of devices) and upcoming key rotation.
AI-written summary · about
chapters (13)
- 0:00Start
- 2:39Asymmetric Cryptography
- 4:35Signatures
- 4:56Authentication
- 6:56Certificate Authority
- 12:24Problem with Certificates Is Subversion
- 16:23Network Security Model
- 18:43Android Debug Keystore
- 22:03Prerequisites
- 29:03Pros and Cons
- 35:59Generate a Key Pair
- 39:37Key Rotation
- 40:17Transparency Reports
