Collaborate Disseminate
I decided to implement "forgotten password" functionality, without having to create a website just for that. The usual workflow that I’ve seen for any app is:
User requests password reset
Link is sent to their email with a token… Continue reading Security of in-app Forgot Password workflow in Xamarin (Mobile App) without using a website
Due to the coronavirus, many governments have required many citizens to install contact tracing app in their phones. I would like to ask whether it is possible for a contact tracing app to access personal information (e.g. photos, videos, … Continue reading Possible concerns with contact tracing app in a pandemic? [duplicate]
When reading about mobile security, the attacker is often assumed to have root access to the device, so as to patch the application or proxy all network traffic.
I see that such applications may have generic vulnerabilities, like non-encry… Continue reading What’s the threat model of mobile security?
The bus company that I use (Arriva UK) is trying to persuade passengers to switch from buying paper tickets to tickets stored on their app. They are particularly pushing this for ‘bus passes’: tickets that allow you to take any bus in a gi… Continue reading Why would a bus ticketing app require an Internet connection when you board the bus?
I have a use case where I need a factory-reset tablet device to install and run a simple Progressive Web Application (PWA). The tablet will be mounted on a wall inside a company building that may host unaccompanied external visitors from t… Continue reading Protecting a PWA authentication token on a public kiosk device
The company is developing robotic smart mobile assistants that enable frontline workers to perform their jobs more safely and efficiently. Continue reading Youreka Labs spins out with $8M to provide smart mobile assistant apps to field workers
I’m interested in the Metamask App (Android) and I’m wondering how exactly the sending of funds works: Since the 12 words (and the corresponding private key) are generated on my mobile device (correct?), what happens when I send funds to a… Continue reading Decentralized Mobile Wallets (esp. Metamask): Security of Private Keys [migrated]
I opened up the Wikipedia app on my iPhone today and saw that the featured article on the main page was on “Henry IV, Holy Roman Emperor”. However, the image displayed for the article was a closeup picture of male genitalia. I was shocke… Continue reading Pornographic image in Wikipedia app
I’m trying to MITM an Android application but I cannot get it to work properly. Usually, I’m using Burp for those kind of attacks, which allows me to intercept and decrypt HTTPS traffic. (Assuming the certificate is installed on the Androi… Continue reading Man-in-the-Middle Mobile (e.g. Android) Application Tool
Suppose I turn on "developer" mode on my Android mobile phone and install a professional GPS spoofing app and a professional VPN app. Developer mode will allow the GPS spoofing app to overwrite my GPS location on the phone, whils… Continue reading Will GPS spoofing + VPN on mobile hide location?