A MORE SECURE WORLD FOR ANDROID APPS
summary
Shows concrete failures and fixes: a loyalty app exposes promo codes via GET without TLS allowing unlimited 100-point loyalty code redemptions; Starbucks stores credentials in plaintext; Equifax leak exposes ~150 million records. Recommends HTTPS + POST + JSON, geofencing for redemption, runtime permission checks, SafetyNet/recaptcha, use tokens (OAuth) with JWT + JWS + JWE for authentication and encrypted exchange, store keys in Android Keystore API (API18/23), and consider Firebase/Auth0 for passwordless and MFA while avoiding SMS-only flows.
AI-written summary · about
chapters (17)
- 0:00Introduction and speaker intro
- 3:05Security risks in mobile apps
- 4:33Case study: Free hamburgers fraud
- 10:45Android permissions in Android 6
- 14:19Human verification with reCAPTCHA
- 15:46Starbucks data leak and storage
- 18:13Encrypting data with Android KeyStore
- 20:23OAuth and session management myths
- 23:58JSON Web Tokens explained
- 27:36Reverse engineering risks in banking
- 29:46JSON Web Encryption solution
- 31:10Password security and user experience
- 33:00Multi-factor authentication options
- 36:14Passwordless authentication methods
- 39:28Identity management with Firebase
- 41:13Enterprise identity solutions
- 42:04Q&A and closing
related talks
46mA More Secure World for Android Apps
53mA More Secure World for Android Apps
24mModern Android App Security: Protecting Code, Keys, and Data
43mSecurity First Android Apps
56mThe Android Security Jungle: Pitfalls, Threats & Survival Tips
36mEnhancing Mobile App Security
28mModern security for Android Developers
47mSecuring Android Applications, The Right Way