Let Standards Light Your Way Best Practices for App Developers
summary
80% of tested apps fail their first assessment, 75% misuse crypto libraries, 85% suffer vulnerable third‑party dependencies and 4 out of 5 offending SDKs already know about the issue. Examples include a hostname verifier that always returns true plus empty exception handlers allowing MITM, a null IV reducing GCM to ECB weakening encryption, hard‑coded keys exposed live with Frida and Jadx demos, WebView addJavascriptInterface leaking tokens, easy RootBeer bypasses, and MASVS/MASTG guidance plus App Defense Alliance validation as the recommended fixes.
AI-written summary · about
chapters (15)
- 0:00Introduction and speaker background
- 1:11Mobile app security failure statistics
- 4:01Challenges in secure mobile development
- 4:22OWASP MASVS overview and benefits
- 7:52MASTG practical security testing guide
- 10:44Live code analysis examples
- 19:22Cryptography vulnerabilities and fixes
- 22:11Post-quantum cryptography readiness
- 25:44Hardcoded secrets and Frida demo
- 28:15WebView JavaScript interface risks
- 30:51Root detection and resilience
- 36:13Standards for app release preparation
- 38:44Privacy compliance with MASVS
- 39:47Mobile Application Security Assessment Program
- 42:37Free MAS validation offer and resources
related talks
33mGuide for lazy developer
31mDevelopers Are Users Too
32mBest Practices in SDK Development
31mDevelopment Standards: A Step-by-Step Guide to Implementing Them Without Pain
26mDesigning Accessible APIs
40mApp Development - Pragmatic Best Practices
57mCore Software Design Principles for Programmers
23mPractical A11Y for Web Apps