Our (financial/banking) mobile app requires user to enter username/password in order to get data via webservice calls. Once user is logged in, credentials are stored in global variable until user logs out. If application is sent to background (text msg, phone call etc.) we would start a timer and log user out if app did not become active again after specified time interval.

One of our customers told us that this is not secure and is asking us to change this behavior and to log user out immediately if application goes into background. They did not want to disclose reason why they think our approach is insecure and we are wondering if what we are doing is really insecure and why, or if they are just overly paranoid.

  • 1
    It's true - there's risk to using a mobile app to do banking. If the user doesn't sign off from their session and leaves the phone sitting around, someone with physical access to the phone (or network access, if somehow compromised) could perform functions available in the mobile app. Then again, logging people off when someone gets a text/phone call is a huge inconvenience (having to log back in each time) and may defeat the purpose of having a mobile app (simplifying access to financial info). Gotta weigh security with accessibility; hard to do both.
    – bangdang
    May 14 '12 at 16:08

Impossible to say what their problem is without a copy of their risk analysis, but three possibilities spring to mind:

  • They may be concerned that a malicious app could hijack the session.
  • They may be worried that users mistakenly think that the app has been closed and all sessions dropped when they background it.
  • They may be concerned that if the phone is stolen there is a window when your app can still be used.

I'm not sure any are a particularly big risk, but of course depends on the full risk assessment. If your app is launching nuclear bombs, for example, I'm not sure it's possible for the customer to be too paranoid.


Once user is logged in, credentials are stored in global variable until user logs out

You should never store username and passwords anywhere in the application. The best practice is to send the credentials over HTTPS to a server and maintain a session using a session ID.

When the app goes background, terminate the session. However, when the app is moved back to foreground, it should ask for credentials once again. These are secure coding standards.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.