Collaborate Disseminate
In my Unity app in C# I am using a 3rd party script which allows me store and retrieve data using iOS keychain. The stored data is a private user generated key which is used to encrypt data before backing the file online (not iCloud).
I ch… Continue reading Storing encrypted data in iOS keychain
it is my first time with MobSF and Android APK assessment. I have found something while testing a specific APK and I am trying to understand the concept behind it:
Under HARDCODED_SECRETS in MobSF, was found a pair of KEY/SECRET related to… Continue reading MobSF Android Activity APK Pentest
While downloading unsafe modded .apk files from the internet and while installing them there is no prompt of "unsafe app being downloaded". But when I install an apk that I made, there is a prompt (just a warning that the app tha… Continue reading Why does Android mark my applications as unsafe? [migrated]
I am increasingly buying IoT aka smart devices for my household.
All these devices need to be connected to WLAN and proprietary app (via bluetooth on iPhone). I do this initial step, but then block the internet access for the IoT device in… Continue reading Are there IoT devices that send data home despite blocked internet connection (with the detour via bluetooth on the phone)?
This is a little bit crazy.
A long time ago, I created a Spotify account using Facebook credentials.
A few years ago, I stopped my premium subscription, deleted Spotify from all devices and didn’t use it again.
3 years ago, I bought a use… Continue reading Mobile App Security for Spotify [closed]
I believe the title says it all.
As an example, let’s say I use the Brave browser on a phone.
From my understanding, all legitimate apps or computer software that connect to the Internet have some form of encryption to prevent other partie… Continue reading If software use encryption to protect one from ISP providers and other parties from snooping, how does this apply to browser software, esp. on mobile?
I am trying to reason about how native apps can avoid the problems web apps have in dealing with the "Browser Cryptography Chicken and Egg" problem, which has been discussed numerous times on this site, perhaps most notably here:… Continue reading How to deal with targeted attacks from publisher when verifying the integrity of native applications and validating their source code?
I have the APK of an application and analyzed it using MobSF static analysis. It says the application talks with Firebase Database and provides a URL.
Obviously, the URL is not accessible.
I am new to this so trying to find tools from GitH… Continue reading How to Scan Firebase Database?
I’m working on a mobile application, using django rest-framework as backend, and I’d like to archive the maximum security possible.
Now when the user log-in with email and password I generate a token, Token Authentication from rest_framewo… Continue reading How to use TokenAuthentication in mobile apps?
I have seen some similar questions a few years old and I am not sure if there are any new changing views on this.
I see that this flow is not recommended for mobile native apps. What are the practical downsides security wise of using this … Continue reading Downside of resource owner password flow for native mobile apps?