Modern security for Android Developers
summary
Concrete takeaways: use Jetpack Security RC 0.3 (alpha 0.02 for older support) with Tink so apps get a master key stored in Android Keystore as an alias rather than rolling your own; biometrics run in the TEE and biometrics stay local—never send biometric data to a server; prefer the secure element (Pixel Titan secure element when available) for key operations; avoid raw certificate files and load certs into a Keystore/KeyManagerFactory used by your OkHttp client; don’t stash secrets in native libs.
AI-written summary · about
chapters (17)
- 0:00Intro
- 3:50Google Recommendation
- 4:18Recifer
- 5:55Algorithms
- 10:31Keychain
- 11:17Solution
- 12:15Think
- 12:54Crypto Library
- 15:03Master Key
- 16:21Local authentication
- 16:53Trusted security execution
- 17:09Range of observations
- 18:34Decompile
- 20:36Secure Data Layer
- 20:56Certificate Authority
- 23:02Questions
- 26:38Geometric Prompt
related talks
18mJetpack Security Extension Overview, Data-at-rest and in-transit
23mData Encryption on Android
43mSecurity First Android Apps
34mDemystifying Android Security
43mSecurity First Android Apps
47mSecuring Android Applications, The Right Way
46mA More Secure World for Android Apps
53mA More Secure World for Android Apps