Tag Info

New answers tagged

-1

All publicly disclosed touchjacking attacks depend on inserting a malicious layer into webviews, not on an unrelated piece of malware. Assuming you are only installing from a trusted source (i.e. signed code from Good) via a trusted platform (Google Play, Apple Store, Microsoft whatever) then touchjacking attacks are unlikely.


0

It turns out that Apple did indeed 'fix' this server-side. Evidently they had a mechanism to force iMessage off when a device tried to send an iMessage. This is anecdotal: My iPhone reverted to standard SMS even when communicating with other iPhones (which also reverted to SMS), and iMessage on my iPad ceased to work. Apple mentioned this bug in iOS ...


0

This is mostly secure. To intercept localhost traffic an attacker would need root privileges and at this point you've already lost as the attacker can also read and modify memory at will - no amount of cryptography will help you as the attacker will get your confidential data straight out of memory. The only issue I see is that you can't prove it's indeed ...


4

Here is a StackOverflow answer for Android: The tapjacking attack has been blocked at the OS level since Android 4.0. For such devices, you do not need to do anything to prevent tapjacking attacks. android:filterTouchesWhenObscured="true" helps on API Levels 9-13. It did not exist prior to that, and so that attribute will be ignored on older ...


4

It's not actual 2FA but 2-step authentication. As linked by StackzOfZtuff they are in fact plain SMS messages. The reason it's two step and not two factor is because two-factor would imply you need true possession of the object where the token is generated and there has to be assurance the token cannot be intercepted by another party. This is where SMS is ...


1

When "Limit Ad Tracking" is turned on, apps are still allowed to collect the IDFA, but they are supposed to (honor system) not use it to Target ads. Nothing stops servers from continuing to Track your device (i.e., collect, store, and aggregate personal, device, or behavioral data along with the IDFA). It is a usage recommendation (enforced only by Apple ...


3

Disclaimer: My company makes a HIPAA-compliant iPod application. I'm responsible for the compliance... The iPhone actually meets many HIPAA requirements out of the box. Once a passcode is set on the device, the contents are encrypted -- which takes care of many HIPAA requirements, notably encryption at rest. For downloading the data, you must use a TLS ...


0

I think your question is "How to perform offline authentication and authorization on an untrusted device?". The short answer to this question is: you cannot. The long answer is: some guys tried to work around this problem, for blue-rays players and video game consoles. To solve the problem they try to make the untrusted device a trusted one, by preventing ...


0

While I am soon going to begin a career dealing with HIPAA, and have therefore been brushing up, I thus far only have experience with PCI compliance. That being said my understanding of what I've looked into so far seems to indicate that both the ePHI itself and metadata of that ePHI (creation date/time, filename, last mod date --- ref. ...



Top 50 recent answers are included