Tag Info

New answers tagged

0

There have been some reports of hacked SIM communications before, like the one explained in this DefCon presentation from 2012, but this is all very much on a basic level and so far there have not been any known exploits for as far as I can tell. That said, in this presentation they did show how you can load custom code on the SIM so it is not hard to ...


0

You could generate a certificate on first run and then use certificate/public key pinning within the app to verify that it is connecting to the right server. This will enable you to use HTTPS over SSL/TLS. Apparently lots of existing apps use self-signed certificates. You could perhaps display the details of the certificate it receives of the first ...


1

Do not use Touch ID for anything beyond the Apple lockscreen. In other words, do not use it in apps, or store/read any detail related to Touch ID in the iOS Keychain. Reason #1: http://whaley.org.uk/andrew/blog/2015/03/08/rbs-natwest-touch-id-security Touch ID can be subverted completely by simply attaching a hooker (such as cycript) and telling the ...


1

Yes, these apps could record what you're typing, or generate arbitrary input events in your stead. There is hardly a thing you can do to prevent input-providing processes from abusing their privileges. This being said, there are some structural factors about how input is handled on mobile UIs that limit the risks of custom keyboards (as opposed to ...


1

My brief research on the Home button showed two trends: (a) the user bypassing it with Accessibility options; (b) using certain features to prevent children from hitting it. It appears that it's a SAK in practice whether or not it's designed for it. Note that this applies to apps that haven't compromised iOS security somehow. If they do that, they might ...


0

No. When an application uses and of Google's identity APIs (to include OAuth and Google+ Sign in) the application receives a token from Google indicating that you are you. Then the application signs you in. One of the major benefits of offloading the password management to Google is that the application doesn't have to store your password (notice that at ...


1

Java servers and Android apps expect the public key in X.509 format, see http://blog.wingsofhermes.org/?p=42 on how to convert.



Top 50 recent answers are included