New Apps, Good Snacks: Effective Threat Modeling for New Territory
summary
Threat modeling for a shared store tablet called Snack Adder evaluates concrete choices: authentication options compared are a 6–8 digit PIN, device authentication flow (short code entered on a logged-in phone), and a dynamically generated QR code (sanitize input). Authorization uses a scoped API token per shop for admin actions; shop sessions default to two weeks, customer checks are single-operation only and revocable. Recommendations: use UUIDs, standard encryption, consult the auth team, minimize data collection, and avoid building custom hardware.
AI-written summary · about
chapters (7)
- 0:00Start
- 5:17THREAT MODELING, BRIEFLY
- 8:54HOW LITTLE DATA CAN WE COLLECT?
- 9:41HOW WILL AUTHN WORK HERE? WHAT'S THIS NEW FRONTIER?
- 12:47AND WHAT ABOUT AUTHZ, THEN?
- 16:43ARE WE GETTING INTO THE SNACK TABLET MANUFACTURING
- 19:18EXPLAINING EFFECTIVELY
related talks
46mA More Secure World for Android Apps
39mAndroid App Security Fundamentals
42mA MORE SECURE WORLD FOR ANDROID APPS
51mSecure Applications, By Design
40mBest practices for shielding mobile apps from emerging threats
33mBest Practices for Mobile App Security Testing
37mOutsmarting Hackers before your App gets pwn'ed
33mHacking and protection of Mobile Apps and backend APIs