Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.
0
votes
0answers
7 views
Does analyst API Flurry break Australian Privacy Act or any other Legal, Regulations, Compliance?
I want introduce Flurry API in my iOS app. But I heard since 2014 Australia start an act to against web page and mobile app to collect user information.
My question is simple:
Does using of API ...
1
vote
0answers
49 views
Imei and phone number given to unknown sources. What are the risks?
The facts:
A friend put his phone number (and possibly the IMEI) for his android device into some kind of hacking PC software that promised to (and actually did) extend its Whatsapp account that was ...
1
vote
0answers
21 views
Is there a TOTP variant that does not require the user to type in a code? [closed]
We're considering a 2 factor TOTP solution on a mobile phone. However, it would be much easier for the user to somehow send the OTP to the server by pushing a button, rather than manually typing in a ...
4
votes
2answers
67 views
Why are apps for mobile devices more restrictive than for desktop?
Application devlopement for mobile devices is generally more restrictive, i.e. the apps runs in a sandboxed environment, they have many limitations when accessing the filesystem, etc. compared to ...
1
vote
0answers
81 views
What is the preferred way of using AWS (specifically S3) from mobile apps?
Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
1
vote
1answer
115 views
How the shopkeepers are getting MAC address of wifi enabled smartphones
It is clear that some big mall's are tracking all the wifi enabled mobile phones before they are connected to the network..how can it been done?
I have the similar issue.. how to get the MAC address ...
2
votes
3answers
129 views
How to detect the “Hello packets” sent by a wifi enabled smartphone
Actually I have a case where I should able to detect the mobile phones and get some data about the device available in my network range without connecting to the network.
I have seen somewhere that a ...
1
vote
1answer
56 views
GSM A5/1 encryption: Key management
I'm currently studying the A5/1 algorithm used for GSM encryption. I understood how thanks to the symmetric private Key and a public counter frame one can encrypt the communication between A and B.
...
2
votes
1answer
74 views
Is it possible to locate a cellphone's location just by ringing it?
With today's technology, is it possible to locate a cellphone's location just by ringing it, kind of like what we see in movies?
0
votes
1answer
83 views
What would be a valid approach to store private keys?
I'm implementing a mobile app which uses AES encryption algorithm to encrypt some critical values being sent to a remote server (basically, the user password), and then decrypted on the server side ...
0
votes
2answers
64 views
Protecting the remote database against tampering in a mobile app
This is the first time I face a mobile app deployment at big scale. This app needs to connect to a remote server where to store and retrieve data.
I discarded connecting directly to the MySQL ...
3
votes
1answer
116 views
Is OAuth always the right choice (and when isn't it)
So I am reluctant to ask too much of a noob question, as this guy aked about a non-standard approach and got down voted a bunch, but here goes.
I am creating a mobile application which needs to ...
85
votes
9answers
38k views
Why can we still crack snapchat photos in 12 lines of Ruby?
Just came across this bit of ruby that can be used to decrypt snapchat photos taken out of the cache on a phone, apparently adapted from here. To my surprise, it worked no problem, considering the ...
3
votes
1answer
94 views
Is mosh now recommended by the security experts? (2014)
Mosh has been around for a while now. Although it's claimed to be "a replacement for SSH" by its authors, mosh does actually depend on ssh to do the initial authentication, after which an instance of ...
3
votes
1answer
69 views
What are industry-standard recommended practices to protect user information in an Android app?
I am developing an Android app that will potentially handle sensitive user data, and some of it may be even considered medical data (for example user height, weight, alergies, etc).
What would be the ...
1
vote
1answer
192 views
Is there any documentation or reviews about LINE messenger security?
I tried to find any documentation about the security of LINE messenger, but I couldn't.
Is there any documentation or reviews about the communication protocol it uses, and whether or not it uses ...
4
votes
4answers
156 views
Contact person by phone, when their phone might have malware
I have a problem setting where I want to contact a user by phone, and where I need to protect the integrity of the phone call as much as possible. I'm wondering about how to design the interaction in ...
1
vote
0answers
117 views
Is it safe to use the official Facebook apps in a public Wifi?
I know, that my login credentials are sent in clear text for every body to read, when I log into facebook without using https from my mobile phone's browser in an public / non encrypted wifi.
And I ...
0
votes
1answer
298 views
What is the risk of leaking IMEI / IMSI numbers over a network
Should I worry if a developer programmed an app to send IMEI / IMSI number of the phone where the app is installed back to him? What can an attacker do with such information?
0
votes
0answers
29 views
Secure data with server and RSA? [duplicate]
the RSA system uses a private key to read the content encrypted with the public key. If I make a game for mobile, and want to save the data :
I guess I cannot save the private key on the device.
If ...
2
votes
1answer
74 views
PCI Complient Storing Credit Card Data On Offline Tablet
I have a client that does work in rural areas where there are no cellphone or internet connections. They need a way to take credit card information in the field, bring it back to their office where ...
2
votes
4answers
188 views
Tails like OS for Smartphones
In Jacob Applebaum's latest talk at the 30c3 conference, he advised all journalists to use Tails or similar OS for their laptops.
Does anyone know of a similar OS or functionality for Smartphones?
...
0
votes
1answer
111 views
Performance of biometric authentication on cell phones as of 2014?
How well do the various biometric authentication methods currently perform in regards to precision and recall? Can anyone cite a relevant research article?
0
votes
1answer
98 views
Cellular Mobile Network Vulnerabilities - Is VPN the solution?
Do current mobile cellular networks like 3G offer enough security? The article from Info-Security states that
3G encryption cracked in less than two hours.
Could a eavesdropper or ...
-1
votes
1answer
70 views
physical access proof smart card for disk encryption [closed]
Current full disk encryption on mobile devices rely on low entropy passwords like PIN numbers or pattern locks. Being able to use a smartcard with such mobile devices is a tempting idea.
I know that ...
0
votes
2answers
112 views
Is there man in middle attack when using mobile phone calls?
My question is about the encryption between me and my mobile operator. My mobile operator uses A5/1. I use Samsung. Sometimes I see the symbol G on my phone which means GPRS. I don't know whether it ...
10
votes
3answers
549 views
Is Gmail showing images by default a good idea for privacy?
Google have decided to show images in Gmail messages accessed via the web, iOS and Android by default:
Instead of serving images directly from their original external host servers, Gmail will now ...
2
votes
2answers
214 views
How to prevent user's mobile phone position tracked
Trying to follow up this post How to trace a (mobile) phone? , the answers on how to prevent being tracked while you own a mobile phone are: You cant. (even if you use disposable phones etc)
1) Why a ...
0
votes
2answers
161 views
Does a simple mobile REST API need HTTPS?
Let's say I have a really simple mobile app with a server API. For example some kind of Q&A app, where users answer questions to win some points ('Who wants to be a Millionaire' kind of game).
...
1
vote
0answers
254 views
Securing REST API for use by mobile apps
I developed a REST API whose clients are mobile apps/websites under my control (API is not open to anyone). Users log into my mobile app/website with their Facebook or g+ login. I'd like to secure ...
0
votes
1answer
59 views
Hardware encryption for mobile data
Assume a requirement for creating a custom application for Android or iOS smartphones, which will send and receive data (documents, e-mails, etc.) to/from a corporate server, perhaps after local ...
0
votes
0answers
37 views
What kind of security do WhatsApp and Viber use? [duplicate]
What kind of security do chat applications implement
to preserve message integrity & confidentiality?
1
vote
1answer
377 views
iOS: sandbox of an iphone app
I am new to iOS so I do have only limited knowledge about iOS in general. For self learning purposes, I would like to know several things as I am quite confused after searching the web.
I do know ...
1
vote
1answer
199 views
Security: Oauth and Mobile apps
This is what I believe are the security implications of integrating Oauth using embedded webview vs browser in mobile application.
Embedded Webview
* Keep UI for mobile app
Security implications
...
1
vote
1answer
135 views
Security implications of shared credentials on private APN
It is common for public APNs to use shared credentials - nearly all mobile networks in the UK use the same credentials across all phones (see here for an example).
In M2M applications such as ...
0
votes
1answer
58 views
Do normal SMS risks apply to DigiCel mobile banking? What mitigations are likely in place?
In this interview with Bill Gates and Bill Clinton, they discuss their work with Digicel, who I assume is this company, to enable mobile banking with normal KYC protections.
This site is full of ...
1
vote
1answer
236 views
Google's Mobile Authentication for REST APIs
So I'm trying to create and secure a mobile REST API on an existing server that runs our web app. We're not going to open the API to the public and we will be writing the client app using ...
1
vote
2answers
94 views
How safe is Money Toolkit?
Money Toolkit is a smartphone app that can alert you to your balances and transactions across multiple accounts.
I was reading their site and whether their practises are as secure as they claim to ...
5
votes
2answers
590 views
How reliable are device IDs provided by PhoneGap on Android and iOS?
I have a web application that allows users to add mobile devices to their accounts (using mobile app).
Each device is uniquely referenced by its UUID. Mobile client is developed using PhoneGap, so ...
1
vote
1answer
122 views
Any risk of email configured for pop/imap access?
If my mobile phone is infected with some malware and the only connection I have to my corporate network is that the email client in the phone is configured for mail (pop/imap), what would be the risk ...
2
votes
1answer
2k views
How to track a Spoofed SMS on Iphone
A mate pulled a quality prank on me the other day by sending me a SMS via a Spoofed number. He's bought a SMS gateway and can set the message ID/phone number to be 'God' (or whatever he wants(letters ...
0
votes
1answer
41 views
Securing data on a mobile device (even from the user/owner)?
I am writing an application to generate OTP codes for two factor authentication where I need to securely store data locally. This data must be secure from both the owner/user as well as intruders. I ...
0
votes
1answer
73 views
Compromised mobile device on a company network [duplicate]
What can a malicious user / attacker do if access is gained to a mobile device (smartphone/tablet) on a company network ?
1
vote
1answer
110 views
Is using an old Android phone for 2-factor authentication safe?
I apologize in advance if this is the wrong place to ask this, I didn't know a better place to start.
I have a rooted HTC Hero (CDMA) that is no longer receiving service and is just kind of...sitting ...
0
votes
2answers
505 views
Do i need SSL certificate signed by a CA for hybrid mobile apps?
I have just stepped into ssl domain and started exploring how to implement ssl. My question is i understand ssl certificates signed by CA actually allow the client or browser to validate that the ...
7
votes
3answers
2k views
How secure is Android's facial recognition?
Android supports using facial recognition for unlocking your phone. How secure is that mechanism?
For instance, if someone has a good quality picture of your face, can they defeat the facial ...
0
votes
1answer
136 views
Does a malicious android WebView break the DoubleSubmittCookie countermeasure against CSRF?
Initial situation:
A RESTful webservice defends against CSRF attacks by using the double submit cookie approach. This means that the authentication token gets submitted twice and verified at the ...
3
votes
4answers
246 views
Key-agreement protocol in a REST API
I have a C# REST API which exposes some methods over the HTTP protocol. The API is intended to be used my my Android applocation (Java) which is currently in the makings.
Since the app is in an early ...
2
votes
1answer
132 views
Danger of peer to peer software [closed]
I wanted to ask what are the risks of using P2P software. I found a lot of information on-line regarding the danger of file sharing but not about the software by itself.
I am writing a mobile ...
3
votes
2answers
105 views
Offloading private key operations to a trusted device
If I have a cryptosystem built around PGP/GnuPG, I can keep my secrets safe by using an OpenPGP smart card and storing my private keys there. If I'm instead using DJB's NaCl, is there any sort of ...
