Don’t get stung by OWASP: An intro into writing code for greater Android Security
summary
Covers OWASP mobile top five risks and gives concrete fixes: marks components exported=false to stop an exported activity bypass via adb demoed with drozer, shows apktool can recompile debuggable APKs, recommends Jetpack Security’s EncryptedSharedPreferences (Tink) and SQLCipher for Room, warns against storing passwords or cleartext, advises filterTouchesWhenObscured for tap‑jacking, disable cleartext in network security config or use certificate pinning/transparency, prefer revocable tokens, avoid rolling your own crypto (use AES‑256 / RSA‑2048 or Google Tink).
AI-written summary · about
chapters (33)
- 0:00Introduction
- 1:27Agenda
- 2:09Mandatory Legal Warning
- 6:27Top 10 Risks
- 7:40Improper Platform Usage
- 12:55Tap jacking
- 15:55insecure data storage
- 20:15encrypted shared preferences
- 25:03insecure communication
- 28:42insecure authentication
- 31:46insecure cryptography
- 34:47recap
- 38:13Whats the dogs name
- 38:48Is it considered insecure
- 39:43Certificate pinning
- 42:17Favorite password
- 43:01How can locally stored sensitive data be exploited
- 43:51Password list login
- 44:34Root beer
- 45:41Encryption
- 45:57Authorization
- 46:27Nondefault keyboards
- 47:33Root detection libraries
- 47:45Network security
- 49:06Mutual SSL authentication
- 49:31ASOS
- 50:13Token session
- 52:46Security issues at work
- 54:16App cloning
- 55:27Free tools
- 56:38Zero knowledge proofs
- 57:45What can be done for apps using SSL pinning
- 58:21What can be done to minimize the risk of exploits
related talks
29mSecuring Android Applications - The not so se…
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
37mPractical security for Android apps
34mDemystifying Android Security
43mSecurity First Android Apps
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security
43mSecurity in Android Applications
24mModern Android App Security: Protecting Code, Keys, and Data