A More Secure World for Android Apps
summary
Shows concrete failures and fixes: Equifax leaks include about 38,000 driver’s licenses, ~3,200 passwords and hundreds of millions of identities, illustrating why clients must stop storing plaintext credentials. Replaces saved username/password with OAuth tokens and JWTs (use jti, sub, exp and JWS/JWE for integrity and confidentiality), store session tokens in SharedPreferences private mode or internal files and protect keys with the Android Keystore. Practical tools covered: SafetyNet/reCAPTCHA, SMS and magic-link flows, Firebase/Auth0 for user management and multifactor setups.
AI-written summary · about
chapters (40)
- 0:00Start
- 0:20A More Secure World for Apps
- 3:09Security is a Team Effort
- 4:29Convenience Over Security
- 6:42Shared Preferences
- 7:36Internal Storage
- 8:23Java Cryptography Architecture
- 9:00AndroidKeyStore
- 9:40Cipher
- 10:00Cryptography Process
- 11:00Security Myth
- 12:20Bad API Design
- 12:50OAuth
- 15:23Signature Algorithms
- 15:36Exploring JWT
- 17:46Registered Claims
- 19:33What problems does JWT solve?
- 22:01Improve API Design
- 22:22User Credentials Problem
- 24:07Password Nightmare
- 32:42Touch ID
- 33:18SMS Code
- 35:32Magic Link
- 37:10Identity Management (IDM)
- 37:37Identity and Access Management (IAM)
- 38:52Firebase Auth
- 41:48What could go wrong?
- 42:36What was wrong?
- 44:27How to solve this issue?
- 46:24Other Suggestions
- 47:12Install-time Requests
- 47:55Runtime Requests
- 48:37Defining Permissions
- 48:53Check for Permissions
- 49:13Request Permissions
- 50:18Fail Encryption
- 50:38JSON Web Encryption
- 51:14Create the Site
- 51:31Adding Dependency
- 51:45Testing
related talks
46mA More Secure World for Android Apps
42mA MORE SECURE WORLD FOR ANDROID APPS
36mEnhancing Mobile App Security
47mSecuring Android Applications, The Right Way
43mSecurity First Android Apps
24mModern Android App Security: Protecting Code, Keys, and Data
29mSecuring Android Applications - The not so se…
28mModern security for Android Developers