2019
Nov
18
revised CORS Trusting Arbitrary Origin on Mobile App
added new tags.
Nov
15
comment CORS Trusting Arbitrary Origin on Mobile App
@SteffenUllrich Hi, I updated the question, tried to make it more clear. Can you give me an example for your second point. If the mobile apps are using web views or anything like a browser, is it possible to make a cross origin request assuming there is not another vulnerability. In web apps the browsers sends the cookies with the request and allows access to the response. Is it possible with a mobile app?
Nov
15
revised CORS Trusting Arbitrary Origin on Mobile App
added 127 characters in body
Nov
15
asked CORS Trusting Arbitrary Origin on Mobile App
Nov
13
awarded  Yearling
Nov
5
awarded  Popular Question
Oct
16
asked Burp: Out Of band resource load
Oct
2
comment Android Keychain: what is a system wide credential?
upvoted but still confused so wont mark it as accepted.
Sep
10
asked How to detect new device in Android?
Sep
7
asked Android Keychain: what is a system wide credential?
Aug
30
accepted Websocket connection hostname check
Aug
25
awarded  Notable Question
Jul
24
comment Is it a good idea to use asymmetric encryption for a chat application?
yes -------------------
Jul
24
comment Is it a good idea to use asymmetric encryption for a chat application?
User key pairs are generated on clients, chat keys are generated on the server.
Jul
24
awarded  Custodian
Jul
24
comment Is it a good idea to use asymmetric encryption for a chat application?
@JensKrüger They get both keys.
Jul
24
reviewed Approve Is it a good idea to use asymmetric encryption for a chat application?
Jul
24
asked Is it a good idea to use asymmetric encryption for a chat application?
Jul
5
awarded  Commentator
Jul
4
comment Websocket connection hostname check
@SteffenUllrich Ok, I think I understood it. Since the certificate check, handshake and shared secret stuff happens when the connection is opened, changing the cert does not affect ws. Attacker does not have access to the shared secret. But the app opens a new connection for each GET request and after receiving the response connection is closed. This way when I change the cert the first GET request fails. Thanks!