Secure your app, fight the leaks
summary
Covers concrete Android fixes: set exported=false for activities/services/providers and use signature-level permission for app-to-app intents; call checkCallingOrSelfPermission on inbound intents; toggle components with PackageManager.setComponentEnabledSetting during login; store files with MODE_PRIVATE, remove sensitive logs and don't rely on BuildConfig.DEBUG (BuildConfig.DEBUG can leak into releases); beware run-as extraction when android:debuggable=true; reject default TrustManager and implement certificate pinning or custom TrustManager (study shows ~50% of apps accept self-signed certs); use proven crypto libs and ProGuard.
AI-written summary · about
chapters (15)
- 0:00App security introduction
- 3:03Corporate vs consumer apps
- 7:44Android data leaks
- 13:26Component security lifecycle
- 15:13Stored data protection
- 19:07Debugging flags risks
- 21:58Network MITM risks
- 24:06HTTPS certificate best practices
- 27:43Encryption key management
- 29:49Device admin hardware controls
- 30:52APK reverse engineering
- 31:37Security vs user experience
- 33:22End user security design
- 34:29Samsung developer tools
- 37:05Q&A browser vulnerabilities
related talks
43mSecurity First Android Apps
29mSecuring Android Applications - The not so se…
43mSecurity First Android Apps
37mPractical security for Android apps
37mBest practices in app security
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
38mAdvanced Techniques for Protecting Android Apps
43mSecurity in Android Applications