DOWNSIDES
Disliked*
Builds fail
Staging vs Production
Slide 15
Slide 15 text
OTHER OPTIONS
DexGuard
DexProtector
Slide 16
Slide 16 text
No content
Slide 17
Slide 17 text
public abstract class e {
private int a = -1;
private String b = null;
protected boolean k = false;
public abstract void a(Intent var1);
protected final void a(String var1) {
this.b = var1;
}
public final void c() {
this.a = -1;
this.b = null;
}
public final boolean d() {
return this.k;
}
}
Slide 18
Slide 18 text
WILL THIS KEEP
THE APK SAFE?
Slide 19
Slide 19 text
No content
Slide 20
Slide 20 text
ADD TAMPERING DETECTION
Slide 21
Slide 21 text
Verify signing certificate at runtime
Verify the installer
context.getPackageManager()
.getInstallerPackageName(context.getPackageName())
.startsWith("com.android.vending")
Check if app is debuggable (or run on emulator)
Slide 22
Slide 22 text
DATA PRIVACY
Slide 23
Slide 23 text
MY PRECIOUS
Slide 24
Slide 24 text
WAYS TO STORE (AND RETRIEVE) DATA
Internal storage
External storage
Content providers*
Slide 25
Slide 25 text
INTERNAL STORAGE
Is (generally) sufficiently safe
Private to your app
Slide 26
Slide 26 text
SHARED PREFERENCES
Useful for primitive key-value based data
Slide 27
Slide 27 text
EXTERNAL STORAGE
Globally readable and writable
Slide 28
Slide 28 text
CONTENT PROVIDERS
Structured storage mechanism
Can be exported (accessed by other apps)
INFORM YOUR USERS
Implement a mechanism for notifying
users (GCM) and forcing updates
Slide 49
Slide 49 text
PLAN AHEAD
Check server security’s impact on devices
https://www.ssllabs.com/
Slide 50
Slide 50 text
No content
Slide 51
Slide 51 text
USE THE PLATFORM TO YOUR
ADVANTAGE
Slide 52
Slide 52 text
android:usesCleartextTraffic="false"
ANDROID M
StrictMode.setVmPolicy(
new StrictMode.VmPolicy.Builder()
.detectCleartextNetwork()
.penaltyLog().build());