Questions tagged [mobile-app]
The mobile-app tag has no usage guidance.
17
questions
1
vote
1answer
46 views
Is certificate pinning enough to protect client (native mobile app) - server communication?
My use case is the following: I want to create an app with React Native that I can deploy on both iOS and Android.
The app should consume an RSS feed (https call) from the server but there is no need ...
1
vote
4answers
291 views
Is 2FA a false sense of extra security on a mobile phone?
I understand that 2FA increases security if you are using two different devices, for instance a computer and a mobile phone.
I fail to understand how these security measurements help if you are doing ...
0
votes
0answers
31 views
Secure Mobile Deeplink login with SAML (Android, iOS)
We want to use deeplink with a schema to login using SAML in our Mobile Apps:
i.e
ourschema://host?code=12345
The problem is that other apps on iOS can read the content of ourschema:// including the ...
0
votes
1answer
29 views
How do mobile apps share details with each other to show customized ads
My question is more towards how this is implemented. I mean do they expose apis to each other or store data at a common place to be accessed by others. Please excuse me if it seems too naive.
0
votes
0answers
29 views
How to secure my mobile application without knowing the source of an uri to display an image?
I would like to know if I expose myself to security problem (potential xss threat?) if I accept unverified external url of images (for instance https://another-website-external-image.png) to be ...
0
votes
0answers
42 views
Designing a user session API for both mobile and web clients
I'm currently working on a project. The apis on the backend will support both mobile and web clients. I'm attempting to design a user management flow for both clients and a bit confused about how to ...
0
votes
0answers
84 views
Repackaging Mobile app which resists repackaging
I tried repackaging an Android app but after installation, when I launch that app, the app crashes immediately.
This is the exception I am getting when I decompile this application using apktool and ...
0
votes
0answers
51 views
Integrating 2FA app into main app
We currently have two distinct apps, one for generating a 2FA token and the other one is the main app. Business is now considering to have only one app left and integrating the authenticator app into ...
1
vote
0answers
117 views
Insecure Binary protection iOS Pentest Report
Thirdparty pentest company reported their findings in our iOS app.
In the report explanation for this vulnerability is
Apple provides default encryption for applications; however, the encryption ...
3
votes
1answer
188 views
MSTG-ARCH-7: All security controls have a centralized implementation
In the OWASP Mobile Application Security Checklist there is a requirement MSTG-ARCH-7 which reads: "All security controls have a centralized implementation".
Now I'm struggling a bit by what ...
4
votes
0answers
179 views
Deauthorization Bug in messenger application - How serious is this?
My question refers to a behavior on a production system with more than 100 million chat users.
Some time ago I changed my account password and removed all devices connected to my account.
The next day ...
5
votes
1answer
196 views
What questions are useful to scope a mobile app pen test?
When arranging a pen test it's common practice to ask the client a set of questions, and use the answers either as the basis for further discussions, or to directly provide a test plan and quotation.
...
-2
votes
1answer
102 views
Securing a read-only REST service for mobile access
I am writing a mobile app that uses a read only REST service that sits behind our company firewall. The actual data supplied by the REST service is not private but I am concerned with a hacker using ...
0
votes
0answers
39 views
Security concern on locally stored authentication token
It is a common method on mobile applications to allow users to bypass authentication process by verifying a locally stored token (previously authenticated) on device.
This is to strike a balance ...
22
votes
7answers
7k views
How to secure a mobile app against its user?
I have created a mobile application that monitors the accelerometer activity and based on that it rewards the user if a specific pattern is observed. How I can secure the application against the user ...
0
votes
0answers
19 views
How can I prevent my server from receiving requests for a modified application? [duplicate]
I am developing an android application and in the future also for IOS, and I use a server in PHP.
Is it possible for my server to know the source of the application sending the requests?
For example,...
3
votes
1answer
215 views
What is the use case of request signing in this mobile app?
The API of a mobile app I was testing is sending the AWS AccessKeyId and SecretKey used for request signing from the AWS Cognito server unencrypted (apart from the regular TLS encryption). Making it ...
