New answers tagged mobile
0
I don't suggest you erase your phone using factory reset as it also can't destroy the personal data completely. But some professionl data wiper tool maybe useful to you, such as iShredder or DroidErase.
maybe these guides are helpful:
https://play.google.com/store/apps/details?id=com.projectstar.ishredder.android.standard&hl=en&gl=US
https://www....
1
I would use something more modern than PBKDF2 (unless required for compliance reasons), and would put an expiration on the local password hashes and local user data (refreshed every time the user successfully authenticates via the server). Also make sure that, if the user tries to log in using the server and fails (as might happen if the user was deleted/...
9
You have a couple of options on what to pin. Depending on which one you chose offers you different trade-offs. Here are some typical pins:
Pin the certificate itself
Yes, you will need to change it when the certificate expires. Most secure but quickly causes availability issues if users don't update often enough.
Pin the public key of the certificate
This ...
0
After some digging, I’ve found the answer to the question.
Essentially, the application needs to authenticate to the server. This means that there has to be a shared secret between the application and the server. However, the secret cannot be hard coded into the application, because it would be copied by cloning.
In Android and iOS, each application instance ...
0
Have you considered signed URLs? If your app has authentication you can get the user to authenticate and then have your app create a custom signed S3 URL for the user. This then gets sent back and can be used directly from the application.
For authentication you can use something like AWS cognito. From this they get an auth token that you validate on your ...
1
Security goal
Let's take a step back here and ask what security goal we are trying to achieve here. I think with any "login session" system the goal is the same, and comes in two parts:
Initial login: the user proves that they are who they say they are; this is usually done with passwords, MFA, email confirmations, whatever.
Maintaining the ...
Top 50 recent answers are included
