Questions tagged [mobile-app]
The mobile-app tag has no summary.
35 questions
1
vote
2
answers
171
views
In PCI DSS SAQ A, does "customer’s browser" include merchant apps using TPSP-provided UI elements for card data?
I’m trying to understand a PCI DSS SAQ A requirement that says:
"All elements of the payment page(s)/form(s) delivered to the
customer’s browser originate only and directly from a PCI DSS
...
0
votes
1
answer
855
views
Do many experts argue that apps are generally more secure than websites? [closed]
The Guardian says:
Many tech experts also argue that apps are generally more secure than websites and allow banks and others to carry out sophisticated ID verification using face, voice and ...
- 447
6
votes
4
answers
3k
views
Whatsapp vs SMS+cell calls
I'm in a country where WhatsApp is "default" messaging app.
I am thinking about deleting my WhatsApp account completely and sticking to the cell calls and SMS.
I, of course, understand that ...
- 61
0
votes
1
answer
201
views
How to securely use service account credentials in an Android App
I have an Android application distributed to my users through an .apk file. That app collects some data, and my goal is to upload that data to a cloud service, like BigQuery. To achieve this, I am ...
- 1
1
vote
1
answer
529
views
Bypassing root detection qualify as a vulnerability?
I am working on security testing of an android application. There is a root detection in the Android application. objection, frida etc. It is possible to bypass this with ways.
My main question is: ...
- 35
1
vote
0
answers
207
views
Is Android SOS being used as privilege escalation or settings bypass?
I have been getting random SOS countdowns triggered on my phone. Every time this happens, a pop-up appears telling me that unknown numbers have been temporarily unblocked. The most recent instance was ...
- 111
2
votes
0
answers
261
views
Storing encrypted data in iOS keychain
In my Unity app in C# I am using a 3rd party script which allows me store and retrieve data using iOS keychain. The stored data is a private user generated key which is used to encrypt data before ...
- 133
1
vote
0
answers
236
views
MobSF Android Activity APK Pentest
it is my first time with MobSF and Android APK assessment. I have found something while testing a specific APK and I am trying to understand the concept behind it:
Under HARDCODED_SECRETS in MobSF, ...
- 11
0
votes
1
answer
406
views
Are there IoT devices that send data home despite blocked internet connection (with the detour via bluetooth on the phone)?
I am increasingly buying IoT aka smart devices for my household.
All these devices need to be connected to WLAN and proprietary app (via bluetooth on iPhone). I do this initial step, but then block ...
- 1,521
2
votes
1
answer
114
views
Mobile App Security for Spotify [closed]
This is a little bit crazy.
A long time ago, I created a Spotify account using Facebook credentials.
A few years ago, I stopped my premium subscription, deleted Spotify from all devices and didn't ...
- 389
0
votes
1
answer
234
views
If software use encryption to protect one from ISP providers and other parties from snooping, how does this apply to browser software, esp. on mobile?
I believe the title says it all.
As an example, let's say I use the Brave browser on a phone.
From my understanding, all legitimate apps or computer software that connect to the Internet have some ...
- 1
1
vote
1
answer
168
views
How to deal with targeted attacks from publisher when verifying the integrity of native applications and validating their source code?
I am trying to reason about how native apps can avoid the problems web apps have in dealing with the "Browser Cryptography Chicken and Egg" problem, which has been discussed numerous times ...
- 13
0
votes
0
answers
161
views
How to use TokenAuthentication in mobile apps?
I'm working on a mobile application, using django rest-framework as backend, and I'd like to archive the maximum security possible.
Now when the user log-in with email and password I generate a token, ...
- 111
0
votes
2
answers
375
views
Downside of resource owner password flow for native mobile apps?
I have seen some similar questions a few years old and I am not sure if there are any new changing views on this.
I see that this flow is not recommended for mobile native apps. What are the practical ...
- 111
3
votes
0
answers
416
views
Security of in-app Forgot Password workflow in Xamarin (Mobile App) without using a website
I decided to implement "forgotten password" functionality, without having to create a website just for that. The usual workflow that I've seen for any app is:
User requests password reset
...
- 131