HTTPS and mobile apps: the story of one implementation or how a fly became an elephant
summary
A mobile developer describes implementing HTTPS communication between iOS and Android apps and servers when business constraints required trusting self-signed certificates or adding extra certificate checks. The talk explains the project’s specific business case, the different design options they tried for secure HTTPS interactions (including Xamarin.Native, Kotlin/Java Android considerations), and the trade-offs, risks, and appropriate uses of self-signed certificates.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 3:28Initial requirements
- 8:08Certificate issues and fixes
- 12:28First solution: Let's Encrypt limits
- 13:56Alternatives: self-signed certs
- 16:51Self-signed certs implementation
- 20:25Pros and cons of self-signed
- 23:57System security and vulnerabilities
- 26:32Android and iOS code
- 29:43Implementation results
- 31:30Q&A
related talks
28mApp Security Essentials
46mSelf-Signed, Why Not! Exploiting Insecure Certificate Validation In iOS And macOS
52mWhere, how, and why is SSL traffic on mobile getting intercepted?
46mA More Secure World for Android Apps
42mA MORE SECURE WORLD FOR ANDROID APPS
45mTen Secrets to Secure Mobile Applications
25mHow SSL Pinning Reinforces iOS App Security
59mLet’s do it right this time: Security in Xamarin mobile apps