Topics of Interest: React Native Security. Addressing typical mistakes
summary
React Native increases attack surface by adding Facebook and optional JS engines so vulnerabilities in Hermes vulnerabilities found matter to apps. Platform APIs behave differently: secure-store keychain vs keystore decrypts at different times and persists differently across reinstalls. Projects accumulate hundreds of dependencies producing surprising counts like 16,000 low vs 2,000 high vulnerabilities, requiring dependency checkers, scheduled update time, native jailbreak/root libraries with bridging, and standard checks using MSVS MSTG applicable.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:47Architecture basics
- 2:24Trusting third parties
- 4:59Secure Store Example
- 7:18Managing Android Permissions
- 8:26Is XSS possible?
- 9:45Jailbreak and Root detection
- 12:20A typical situation
- 13:22Monitoring dependencies
- 14:02What if there is no fix?
- 14:54Plan time carefully!
- 18:11How do we test RN app security?
- 20:34Final thoughts...
- 20:55Where to go next?
related talks
25mReact Native in Practice
27mBuilding high quality mobile apps with React Native
25mReact developers in a wild world of native apps
23mStability First: Building React Native Apps That Scale
56mBuilding Secure ReactJS Applications: Mastering Advanced Security Techniques
45mQ&A Panel
55mNative Keynote
12mReact to React Native: How Hard Could It Be?