4 ms·

google.com scores 50/100. This is one of those scanners crappy pentesters use for multi page reports of false positives?

• mavamaarten 2y ago
  Hah this triggers me. Last week we got a pentest done on our apps. This week we got some high-prio tickets on our board because they found major security violations!!! Our app, which uses an API, used a dangerous permission! "android.permission.INTERNET" How they can report this with a straight face, I don't know. Makes me want to go in the security business though, if that is the level of competence I'm absolutely positive that I could do that job and earn a lot more than a generic app developer.
  • CrimsonRain 2y ago
    > Why isn't the app obfuscated, why can it be run on rooted device and why doesn't the app use https with pinning? The app in question: a wrapper of a PWA ticket purchase webapp which saves no payment info. Being able to run on rooted device was determined as severe category.
    • k4rli 2y ago
      This idiocy can be seen very frequently. Even McDonalds app doesn't allow rooted users...
      • therein 2y ago
        It always makes me think, this app is not secure in theory if they are worried about rooted users.
  • SebFender 2y ago
    From experience, most are very junior and use automated solutions which just don't make sense. When we do ours we really focus on core elements and very material findings... as everyone should. But competency is so rare in this field it's hard to follow.