4 ms·
> You just install it on your phone and use the app. Some people on the cybersecurity side are starting to cry....
by nicce 17d ago
> You just install it on your phone and use the app.
Some people on the cybersecurity side are starting to cry....
- user43928 17d agoI have been getting these comments often here, including concerns about my non existent backend's security. Last time, when I pointed out that the attack surface for mobile apps is typically very small, some users started to talk about zero day vulnerabilities in the OS's media handling, as if it was a concern for my app implementation. I found the concerns again wildly overblown.
- freeplay 17d agoBut what if someone discovers a iOS 0day worth several million dollars and burns it to compromise your app specifically? /s
- joenada 17d agoYou sound like a person who's never had their app pen tested. The attack surface is anything but small if you're working with any kind of sensitive data.
- Perz1val 17d agoWhy? The api has to be secure. Mobile os keeps the app safe. Where is the attack surface?
- chis 17d agoAre there cybersecurity concerns in the frontend? I would have thought you have to assume the client is untrusted and only do security work on the backend
- nicce 17d ago1. Not storing secrets properly or using hardcoded secrets 2. Wild use of webviews/iframes sometimes easily propagates as XSS in phones 3. Incorrect client-side OAuth 2.0 configuration e.g. with schema-based redirect URLs. 4. Not supporting high-enough API versions, which may prevent some OS-related weaknesses 5. The list is actually very long. Just few top of my mind.
- chis 17d agoFantastic answer thank you
- rudedogg 17d agoDoing anything right on web is 10x harder and more complex. The problem is the browser, once you use it to deliver anything you have to buy into all of it’s bullshit. CORS, XSS, headers, caching. All that just goes away (outside your backend API, if you even need one) when you ship a native app
- Matumio 17d agoMy favourite is a logout button with a logout API that fails. (Not a huge pratical concern, I admit, because it's a local attack.) Nobody ever notices because it still shows the logout screen, which hides the API error toast (if errors were even displayed). The still valid refresh token stays in sessionStorage (or even localStorage) while the app displays "logged out". (Bonus points if you cleared the access token in the error handler but not the refresh token, and on page reload you ask the user to log in again despite having a valid token.) Or a login form that gets hidden after login, but clears the username and password only when you click "login back in". (Bonus points if the backend also enforces a 5min session timeout "for security".)
- user43928 17d ago
- Culonavirus 17d agoThey better start a proper hydration regime because they'll be crying a lot.