Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Our (financial/banking) mobile app requires user to enter username/password in order to get data via webservice calls. Once user is logged in, credentials are stored in global variable until user logs out. If application is sent to background (text msg, phone call etc.) we would start a timer and log user out if app did not become active again after specified time interval.

One of our customers told us that this is not secure and is asking us to change this behavior and to log user out immediately if application goes into background. They did not want to disclose reason why they think our approach is insecure and we are wondering if what we are doing is really insecure and why, or if they are just overly paranoid.

share|improve this question
1  
It's true - there's risk to using a mobile app to do banking. If the user doesn't sign off from their session and leaves the phone sitting around, someone with physical access to the phone (or network access, if somehow compromised) could perform functions available in the mobile app. Then again, logging people off when someone gets a text/phone call is a huge inconvenience (having to log back in each time) and may defeat the purpose of having a mobile app (simplifying access to financial info). Gotta weigh security with accessibility; hard to do both. –  bangdang May 14 '12 at 16:08

2 Answers 2

Impossible to say what their problem is without a copy of their risk analysis, but three possibilities spring to mind:

  • They may be concerned that a malicious app could hijack the session.
  • They may be worried that users mistakenly think that the app has been closed and all sessions dropped when they background it.
  • They may be concerned that if the phone is stolen there is a window when your app can stil be used.

I'm not sure any are a particularly big risk, but of course depends on the full risk assessment. If your app is launching nuclear bombs, for example, I'm not sure it's possible for the customer to be too paranoid.

share|improve this answer

Once user is logged in, credentials are stored in global variable until user logs out

You should never store username and passwords anywhere in the application. The best practice is to send the credentials over HTTPS to a server and maintain a session using a session ID.

When the app goes background, terminate the session. However, when the app is moved back to foreground, it should ask for credentials once again. These are secure coding standards.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.