iPhone - logging out user when app goes into background

Question

Our (financial/banking) mobile app requires user to enter username/password in order to get data via webservice calls. Once user is logged in, credentials are stored in global variable until user logs out. If application is sent to background (text msg, phone call etc.) we would start a timer and log user out if app did not become active again after specified time interval.

One of our customers told us that this is not secure and is asking us to change this behavior and to log user out immediately if application goes into background. They did not want to disclose reason why they think our approach is insecure and we are wondering if what we are doing is really insecure and why, or if they are just overly paranoid.

Answer 1

Impossible to say what their problem is without a copy of their risk analysis, but three possibilities spring to mind:

• They may be concerned that a malicious app could hijack the session.
• They may be worried that users mistakenly think that the app has been closed and all sessions dropped when they background it.
• They may be concerned that if the phone is stolen there is a window when your app can stil be used.

I'm not sure any are a particularly big risk, but of course depends on the full risk assessment. If your app is launching nuclear bombs, for example, I'm not sure it's possible for the customer to be too paranoid.

Answer 2

Once user is logged in, credentials are stored in global variable until user logs out

You should never store username and passwords anywhere in the application. The best practice is to send the credentials over HTTPS to a server and maintain a session using a session ID.

When the app goes background, terminate the session. However, when the app is moved back to foreground, it should ask for credentials once again. These are secure coding standards.