Mobiconf 2018: Tomek Cejner, SmartRecruiters
summary
Practical checklist for iOS app security: enable ATS forces HTTPS and TLS >=1.0, restrict exceptions, and defend against MITM with certificate pinning by public key vs whole-certificate pinning (beware frequent cert rotations); use MDM for app-specific VPNs; choose correct file protection class (Complete, Complete Unless Open, Until First Unlock, None) and keep sensitive files out of backups; store secrets in Keychain and prefer OAuth2 with short-lived access tokens + refresh tokens; tie keys to LocalAuthentication and/or keychain items accessible only when passcode set; disable custom keyboards and block background screenshots; follow OWASP MASVS and Mobile Top Ten and validate with audits or proxies like Charles.
AI-written summary · about
chapters (13)
- 0:00Introduction and motivation
- 2:04Trust as the core value
- 3:33Network communication security
- 9:04Certificate pinning techniques
- 12:00Data store encryption
- 17:25Keychain and secrets storage
- 21:46OAuth 2.0 for authentication
- 26:47Refresh tokens and security
- 28:12Biometric authentication
- 31:52Enterprise security practices
- 34:47Threat modeling and audits
- 37:21Security standards and layers
- 38:06Balancing security and UX
related talks
44mPractical Security
45mTen Secrets to Secure Mobile Applications
47mSecurity Threats & Mitigations for iOS Developers
27miOS Attack Vectors and how to protect your app
28mApp Security Essentials
01h 02mLock That Sh*t Down! Auth Security Patterns for Apps, APIs, and Infra
37mOutsmarting Hackers before your App gets pwn'ed
46mA More Secure World for Android Apps