New answers tagged

11

Use Android SafetyNet. This is how Android Pay validates itself. The basic flow is: Your server generates a nonce that it sends to the client app. The app sends a verification request with the nonce via Google Play Services. SafetyNet verifies that the local device is unmodified and passed the CTS. A Google-signed response ("attestation") is returned to ...


0

This problem is something that mobile games have to deal with for income reasons, and from what I can tell, they deal with this by constantly updating the app, requiring the user to download and install a fresh patch every time before they start the game. usually this is a small amount. These patches also add new content to the game. The patches also handle ...


18

This is impossible. Anyone who has the integer APK file can decompile it and make a malicious clone that behaves in exactly the same way towards the server.


1

It highly depends on the kind of data you offer for downloading and what kind of trust relationship there is between the user and your site. Just take a closer look at what HTTPS offers and what not: It offers some kind of privacy through encryption. If the data are already encrypted by other means then you don't need another layer of encryption. If the ...


4

Any website owner can see what IP address is doing things on their website. This applies whether HTTPS is in use or not. Any node operator (ISP, CDN provider, gateway operator) can see traffic passing through the nodes they operate. They can see both the apparent source of traffic, and the destination - they need to in order to be able to correctly route ...


0

When you do a HTTPS request, the packets which transit on the network contains both the origin IP and the destination IP. Each owner of a node you transit by can see those packets, and read these information, even if they can't decrypt the message. They might use the destination IP to guess which site you are connecting to (or use other techniques like DNS ...


0

If a reliable provider wants to change their JavaScript, they have to update the integrity hash and distribute that to all possible users. Not if the caching policy means that the referer will not be cached for longer than the referee. It's another strong argument for using long expiration times for static content and injecting a variable into the URL. ...



Top 50 recent answers are included