Practical Security
summary
Practical, actionable rules: turn on HTTPS and stop disabling ATS; use certificate pinning with yearly rotation (bake next cert into app, keep a short rotation cadence) to reduce root trust. Store data with iOS file protection flags — file protection levels: Complete / Unless Open / Complete Until First User Authentication. Protect passwords with salted, stretched hashes and authenticated encryption — use PBKDF2 + random salts + stretching + HMAC‑authenticated AES‑CBC and prefer a vetted cross‑platform library rather than rolling your own.
AI-written summary · about
chapters (23)
- 0:00Intro
- 1:37HTTPS
- 3:37A LOT OF TRUST
- 8:48ENCRYPT YOUR TRAFFIC
- 10:09DATA PROTECTION (SIMPLIFIED)
- 11:24PROTECTION LEVELS
- 13:15HOW EASY?
- 13:34DATA PROTECTION IN CODE
- 18:36HASHING
- 20:06CHOOSE YOUR HASH
- 22:18WHAT WENT WRONG AT LINKEDIN?
- 25:00SALTING
- 26:21DETERMINISTIC SALT
- 27:42STRETCHING
- 27:52TIME TO CRACK
- 29:00PBKDF2
- 30:59STORE A HASH
- 32:33GOOD PASSWORD HANDLING
- 34:31WHAT IS CORRECT AES?
- 35:38THE HELPERS
- 35:50INCORRECT KEY GENERATION
- 42:21ENCRYPTION PITFALLS . Poor cipher choice
- 43:03PRACTICAL SECURITY
related talks
28mApp Security Essentials
52mPrivacy & Security, Policy & Technology
45mTen Secrets to Secure Mobile Applications
37mOutsmarting Hackers before your App gets pwn'ed
25mHow SSL Pinning Reinforces iOS App Security
01h 02mLock That Sh*t Down! Auth Security Patterns for Apps, APIs, and Infra
24mSecurity : protect the body of your app
27miOS Attack Vectors and how to protect your app