Security First Android Apps
summary
Checklist-style practical fixes for Android app security: use EncryptedSharedPreferences not plain prefs; set android:exported=false for components unless absolutely needed; enable ProGuard and never bake secret keys into the APK; generate RSA keys with specBuilder.setIsStrongBox(true) so devices use StrongBox over TEE when available; defer dangerous permissions, require biometric or recent re-auth for sensitive actions, sanitize deep links and notifications (end-to-end encrypt), lock down WebView JavaScript and add a network security config and PKCE for OAuth.
AI-written summary · about
chapters (17)
- 0:00Introduction and setup
- 2:59Storing sensitive data in apps
- 4:02Content providers and manifest security
- 5:26Protecting code with ProGuard
- 8:56Sensitive data on devices
- 13:06Permissions and deferring access
- 15:36User authentication for sensitive info
- 17:42Entry and exit points in apps
- 18:03Deep links and security
- 20:50Broadcast receivers and services
- 22:12Secure notifications with encryption
- 26:27Web views and security risks
- 30:44Network security config file
- 32:30OAuth 2.0 with PKCE
- 39:18Play Services security provider
- 40:21Private keys in GitHub
- 42:48Summary and Q&A
related talks
43mSecurity First Android Apps
47mSecuring Android Applications, The Right Way
39mAndroid App Security Fundamentals
41mSecure your app, fight the leaks
43mSecurity in Android Applications
56mThe Android Security Jungle: Pitfalls, Threats & Survival Tips
01h 02mDon’t get stung by OWASP: An intro into writing code for greater Android Security
24mModern Android App Security: Protecting Code, Keys, and Data