O-mg what's new in Android Security?
summary
Covers concrete Android O steps: use Play Services SafetyNet APIs to list harmful apps, call Safe Browsing lookup (free tier ~10,000 requests/day) and perform server‑side validation of SafetyNet attestation tokens checking CTS_PROFILE_MATCH and basicIntegrity flags rather than trusting the client, integrate reCAPTCHA via server verification, add SMS Retriever using the app signing certificate hash, enable WebView Safe Browsing with a manifest tag, use Network Security Config and drop SSLv3, and opt into Google Play App Signing (upload key revocable, permanent enrollment, server-side APK optimization).
AI-written summary · about
chapters (13)
- 0:00Introduction and speaker intro
- 2:38SafetyNet API overview
- 8:09SafetyNet attestation API
- 13:05Google Play Services hardware keys
- 14:10SMS retriever API
- 16:19Android Oreo security updates
- 21:13Autofill in Android Oreo
- 24:07WebView security improvements
- 25:51Network security config
- 27:35New permissions in Oreo
- 28:39Device identifiers changes
- 31:06Google Play app signing
- 37:45Future of Android security
related talks
32mWhat's new in Android security
32mDebunking Android Security Myths with Data
06mKeeping Google Play Safe: Key privacy and security initiatives and resources
39mAndroid App Security Fundamentals
34mDemystifying Android Security
56mThe Android Security Jungle: Pitfalls, Threats & Survival Tips
43mWhat’s NNNNNNNNew in Android Security?
43mSecurity First Android Apps