A More Secure World for Android Apps
summary
Shows concrete failures and concrete fixes: a loyalty app leaks redeem codes and credentials over GET and no TLS — remedy is use TLS and POST plus a geofence to stop remote redemption. Documents Starbucks storing plaintext credentials — remedy is Android Keystore for keys and per-device encrypted storage (AES/RSA). Recommends auth patterns: OAuth with short-lived JWT + JWS for integrity and notes JWE for payload encryption. Covers human checks (reCAPTCHA/SafetyNet), runtime permissions, fingerprint/SMS/magic-link flows, Firebase and Auth0 capabilities for passwordless and MFA.
AI-written summary · about
chapters (15)
- 0:00Introduction and speaker background
- 1:13Root access limitations on Android
- 4:04Loyalty app security flaw case study
- 8:22Android permissions and runtime requests
- 11:52Human verification with reCAPTCHA
- 13:40Starbucks app security breach analysis
- 17:28OAuth and session management standards
- 20:38JSON Web Tokens explained
- 26:35Failures in encryption implementation
- 29:43Password security and authentication challenges
- 32:31Multi-factor authentication methods
- 34:37Federated identity and single sign-on
- 38:05Passwordless authentication techniques
- 41:57Identity management solutions
- 45:29Q&A and closing remarks
related talks
42mA MORE SECURE WORLD FOR ANDROID APPS
53mA More Secure World for Android Apps
37mPractical security for Android apps
36mEnhancing Mobile App Security
29mSecuring Android Applications - The not so se…
24mModern Android App Security: Protecting Code, Keys, and Data
43mSecurity First Android Apps
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security