Security First Android Apps
summary
Concrete app-hardening steps and failures: use AndroidX Security for encrypted SharedPreferences, set android:exported="false" on providers/broadcasts, generate per-account RSA keys and send the public key to the backend for end-to-end encrypted notifications, and require lock screen or use StrongBox/TEE to protect private keys. Enable ProGuard (obfuscation slows easy decompilation), enforce PKCE for OAuth, add a network_security_config with cleartext=false and debug overrides off in release, call ProviderInstaller to update security provider, and set launchMode singleTask/singleInstance to mitigate StrandHogg.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 0:27Security basics like a moat
- 2:34Storing sensitive data securely
- 7:25ProGuard and private keys
- 8:09Hardware security modules
- 11:22Permissions and user data
- 14:17Deep links and entry points
- 17:49Secure notifications
- 24:10WebView security risks
- 27:00Network security config
- 29:29OAuth 2.0 and security
- 36:42Security provider installer
- 37:44Private keys in Git
- 39:52Task affinity vulnerabilities
- 42:39StrandHogg attacks
- 43:00Summary and takeaways
related talks
43mSecurity First Android Apps
47mSecuring Android Applications, The Right Way
24mModern Android App Security: Protecting Code, Keys, and Data
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
37mPractical security for Android apps
56mThe Android Security Jungle: Pitfalls, Threats & Survival Tips
28mModern security for Android Developers
39mAndroid App Security Fundamentals