From HTTPS Basics to Network Security Configuration
summary
Covers Android N+ network_security_config features for HTTPS: how apps can restrict trusted CAs, set per-domain cleartext rules, and implement certificate pinning using SPKI hashes. Shows how to generate pin digests with OpenSSL or a Python script, explains enforcement points in framework classes (manifest config parser, NetworkSecurityTrustManager), and presents two rollout strategies: an ideal double‑pin swap requiring forced updates and a pragmatic expiry‑based swap that avoids forced updates but weakens pin guarantees.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:11HTTPS importance
- 5:32HTTPS purpose
- 6:42Certificate and CA roles
- 8:14HTTPS handshake
- 11:35Network Security overview
- 12:43Configuring security
- 14:11SSL pinning setup
- 16:04Network Security implementation
- 19:01SSL pinning on Android N
- 21:19SSL pinning operations
- 23:59Pinning trade-offs
- 25:31Summary
related talks
43mWhat’s NNNNNNNNew in Android Security?
41mKeep it Secret, Keep it Safe
37mPractical security for Android apps
40mBEST PRACTICES FOR ANDROID ENTERPRISE APPLICATION DEVELOPMENT
58mSecure Networking with SSL
34mDemystifying Android Security
29mSecuring Your Android Network Calls, from 2009 to 2019
44mPractical Security