I'm beginning with Android App development and I want to make sure that I'm taking the proper security precautions since most apps will handle sensitive data.

What security precautions should be taken in order for my app and the data it handles to be secure? (precisely, my worst case scenario thread model would be a well funded attacker trying to get to the data handled by the app in whatever way it can)

I know that,

  • The signing key must remain secure
  • Data should be stored within the apps sandbox (preferably encrypted)
  • Data should be encrypted end-to-end

But should I, for example use windows as a development platform or is linux more advisable in this case.

The sort of apps I'm planning to make will be primarily data transfer and communication apps.

Any thoughts are appreciated!


The development platform has as close to nothing to do with the security of your app. It might, if your development machine is not properly secured or directly targeted.

The number one rule you have to follow is to not implement your own crypto. Use well known and tested libraries.


A few things come to mind.

Avoid storing things locally that should not be exposed. Data like sessions, cookies, passwords, account details, whatever. There have been numerous and various ways that data gets dug out of mobile apps and reused. As a rule of thumb, if it's data that is specific to that user (the user's session, the user's ID, the user's account number) that's more suitable for caching on the device than something that is the same for everyone. Imagine you have a license key for streaming media from a CDN, or an API key for a web service (á la OAuth), or something like that. Those sorts of shared secrets shouldn't be embedded in the app or cached in the app's local storage. Here's an example failure.

Remember that any server-side component has to authenticate and authorise all the API calls to it. It's common to create microservices like viewing open orders, checking for available files, or whatever, and have them not require a valid session. It's also common to have those microservices accept ANY sorts of requests, as long as there's ANY valid session. So make sure that you don't rely on the mobile app to determine what the user should and shouldn't see. That has to be enforced server side.

That's two biggies that come to mind. There's more, but we can't give you a book in a response.

Not the answer you're looking for? Browse other questions tagged or ask your own question.