Software Architect. Photographer. Musician. Dad. Peter wrote his Diploma thesis on a multitouch finger detection library for Multitouch Tables. Then came the iPhone and changed everything. He has been doing mobile development ever since. Today He works as a Software Architect for MaibornWolff an IT Consultancy. He has worked on Apps for BMW, Rolls-Royce, Mini, DigitalCharging Solutions, Deutsche Post and many more. Peter is a regular speaker at conferences and Meetups and back in the day even gave a lecture at university: https://bit.ly/4mnGYC6 https://speakerdeck.com/pkurzok 2025-11-13 13:07:39 -0500 Building secure mobile apps is no longer optional—it’s expected by users, businesses, and the ecosystem. This talk offers a practical, beginner-friendly introduction to mobile security for iOS developers who want to improve their apps without getting lost in theory. We’ll cover essential tools for analyzing app behavior, including network proxies and IPA inspection, and explain how code signing and entitlements define trust boundaries. We’ll also explore secure data storage with Keychain and file encryption, followed by key networking protections like certificate pinning and device attestation. Attendees will gain a clear understanding of the mobile threat landscape, see real-world pitfalls, and learn actionable techniques they can apply immediately. The goal is to help developers make informed, security-first decisions and build resilient apps by design. Building secure mobile apps is no longer optional—it’s expected by users, businesses, and the ecosystem. This talk offers a practical, beginner-friendly introduction to mobile security for iOS developers who want to improve their apps without getting lost in theory. We’ll cover essential tools for analyzing app behavior, including network proxies and IPA inspection, and explain how code signing and entitlements define trust boundaries. We’ll also explore secure data storage with Keychain and file encryption, followed by key networking protections like certificate pinning and device attestation. Attendees will gain a clear understanding of the mobile threat landscape, see real-world pitfalls, and learn actionable techniques they can apply immediately. The goal is to help developers make informed, security-first decisions and build resilient apps by design. Tue, 08 Sep 2026 00:00:00 -0400 https://speakerdeck.com/pkurzok/mobile-security-fundamentals-build-apps-that-fight-back https://speakerdeck.com/pkurzok/mobile-security-fundamentals-build-apps-that-fight-back In this talk we take a closer look at the DeviceCheck framework and the services it provides to make our apps and backend services more resilient against unauthorised use. We will compare device identification and app attestation and show how we can validate the integrity of our app. The DeviceCheck Framework has been around since iOS11 but nobody has ever really heard about it. At least not me… I stumbled opon this when playing around with some new Firebase Service. They enforce their own version of this called AppCheck for some services by now. So I wanted to find out how it works and dug deeper. In this talk I take a look at the two services the framework provides: DeviceIdentification and AppAttestation. I will show client and server implementation for iOS and Vapor and show how to make your network communication more secure. It’s not a silver bullet, but an alternative or addition to certificate pinning and another tool in our iOS Dev tool belt. In this talk we take a closer look at the DeviceCheck framework and the services it provides to make our apps and backend services more resilient against unauthorised use. We will compare device identification and app attestation and show how we can validate the integrity of our app. The DeviceCheck Framework has been around since iOS11 but nobody has ever really heard about it. At least not me… I stumbled opon this when playing around with some new Firebase Service. They enforce their own version of this called AppCheck for some services by now. So I wanted to find out how it works and dug deeper. In this talk I take a look at the two services the framework provides: DeviceIdentification and AppAttestation. I will show client and server implementation for iOS and Vapor and show how to make your network communication more secure. It’s not a silver bullet, but an alternative or addition to certificate pinning and another tool in our iOS Dev tool belt. Thu, 13 Nov 2025 00:00:00 -0500 https://speakerdeck.com/pkurzok/device-check-securing-your-apps-communication https://speakerdeck.com/pkurzok/device-check-securing-your-apps-communication