Currently, I'm developing a bank related android app. I would share my knowledge and also maybe you guys are more expert than me so you can add your ideas to the list.
Bank is a very special client. They really concern about security stuff. However, in the same time, they want to have very flexibility and great feature to comfort their users. I really think both security and convenience do not relate to each other.
So what have I done are:
- Use SSL to communicate from app and web API.
- Using token authentication to ensure if the request to API is from official app. Most likely, I will use a shared token key that is updated every month. The token will be based on agreed random string, android id and the application id.
- To prevent reversed engineering, I use proguard for obfuscate the app itself. I am not really sure how secure are proguard but Java Class are very easily reversible. Hopefully, with proguard it may makes it harder.
- I also use MCSSID from simcard and Android ID to validate each user login and when application launched. Once, the SIMcard is changed, user need to re-register all information (such as CC number, mobile phone and OTP from bank). Also, the server will check once the android ID is not match. The server will flag the transaction with higher risk. Bank may call them to verify about their transaction.
- The app will not be able to run on Rooted devices. If the devices is rooted, it will not allow to continue and finish the running activity after alert.
- Also, in the future, I'm planning to regularly check user behavior login (such as, Time, Location based) to ensure if any unusual activity will be flag as high Risk
From steps taken above, is there anything preventive action that I can push more in the security sides?