Security at your fingertips
summary
Explains how Android Marshmallow actually generates and protects keys using KeyGenParameterSpec and the Java Crypto APIs, shows AES‑256 key creation with KeyGenerator and use of Android Keystore so private keys never leave the device, demonstrates setUserAuthenticationRequired and setUserAuthenticationValidityDurationSeconds to tie keys to recent unlocks and the FingerprintManager flow, cites hardware‑backed TEE on ~80–90% of devices, notes lockscreen adoption jumps from ~50% to >90%, and a working demo app on GitHub.
AI-written summary · about
chapters (9)
- 0:00Start
- 1:06BROKEN / NO CRYPTOGRAPHY
- 1:46How can I, as an Android developer, store my user's sensitive information securely in my app?
- 2:27Let's start at the beginning!
- 4:06Android 4.1/4.3 4.1 introduced the keymaster HAL
- 5:20Android 6.0 improved everything
- 17:01Credential verification in hardware (e.g. TrustZone)
- 17:45Secure lockscreen adoption on Nexus devices went from 50% to 90%
- 24:17If a fingerprint scanner is available, use the API to test for user presence
related talks
30mAdvanced Android Fingerprint Security
23mData Encryption on Android
47mSecuring Android Applications, The Right Way
28mModern security for Android Developers
34mDemystifying Android Security
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security
37mPractical security for Android apps
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security