Timeline for Android Application - Credentials in RAM
Current License: CC BY-SA 4.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 31, 2019 at 7:52 | comment | added | domen | @forest it's also implied that's their solution, which means it could be redesigned. I can't find a popular implementation of challenge/response for web sessions though, so maybe it's not viable. | |
| Jul 31, 2019 at 6:00 | history | tweeted | twitter.com/StackSecurity/status/1156444465327935488 | ||
| Jul 31, 2019 at 5:56 | comment | added | forest | @domen OP is talking about a session token. I'm not sure how a keystore could help with that. | |
| Jul 31, 2019 at 5:55 | answer | added | forest | timeline score: 1 | |
| Jul 30, 2019 at 15:45 | comment | added | domen | Depending on the requirements/design, you might be able to use keystore to have key material outside of the app memory. | |
| Jul 30, 2019 at 12:53 | comment | added | schroeder♦ | If you encrypt this data and place it in memory, you are going to have to decrypt it in memory at some point. | |
| Jul 30, 2019 at 12:52 | comment | added | schroeder♦ | So, you are asking how to mitigate this as an application developer? Not as the device owner? If so, please edit your question to include that. | |
| Jul 30, 2019 at 12:32 | comment | added | user3091216 | Yet this is not something that can be decided by the application owner, if the mobile phone is rooted and the application is installed on it | |
| Jul 30, 2019 at 12:14 | comment | added | schroeder♦ | The mitigation is to not root the phone and break the security barriers between memory locations. | |
| Jul 30, 2019 at 12:13 | history | edited | schroeder♦ | CC BY-SA 4.0 |
deleted 9 characters in body; edited tags
|
| Jul 30, 2019 at 12:00 | review | First posts | |||
| Jul 30, 2019 at 12:48 | |||||
| Jul 30, 2019 at 11:57 | history | asked | user3091216 | CC BY-SA 4.0 |