10 Things you Need to Know before Implementing Cryptography
summary
Mobile apps leak more in architecture and habits than in crypto: analysis of 301 vulnerabilities, 17% inside crypto libraries shows most failures are misuse. Practical fixes include iOS 11 password autofill and associated domains, TLS 1.2/1.3 with HSTS and SSL pinning, use libs like Themis or libsodium for storage integrity, rotate session keys for forward secrecy, run GitHub security alerts and npm audit, scan commits for keys, and watch supply chains after incidents like XcodeGhost and modified Xcode torrents.
AI-written summary · about
chapters (36)
- 0:00Intro
- 1:00Open Source Cryptography
- 4:15Sensitive Data
- 4:31App Rejections
- 4:59Privacy
- 5:25Screenshots
- 5:59Green Shield Kit
- 6:35Permissions
- 7:14Android
- 8:08Password Rules
- 9:34Authentication
- 10:22Passwords
- 10:59Touch ID
- 12:16User Password
- 12:34Login Flow
- 14:14Sensitive plaintext
- 14:50Not only passwords
- 15:18Inspector Clouseau
- 15:52Open Source
- 16:12GitHub
- 19:01SSL Certificate Expiration
- 19:21Certificate Authority
- 20:30Symmetrical Session
- 21:07Xcode Ghost
- 22:57Sync
- 23:54Command and PM Audit
- 25:57Obfuscation
- 27:14Other fun things
- 30:25Bad situation
- 30:50Complex things
- 31:02Library recommendations
- 32:52TMobile
- 33:45Wrap up
- 34:53Home reading
- 35:20Other topics
- 35:40Audience questions
related talks
45mTen Secrets to Secure Mobile Applications
39mMobile App Security
27miOS Attack Vectors and how to protect your app
48mHow to Meet the New Mobile Application Security Imperative
37mOutsmarting Hackers before your App gets pwn'ed
44mCryptography Pitfalls
47mSecurity Threats & Mitigations for iOS Developers
36mUse Cryptography; Don't Learn It