3 ms·
For mobile apps that use WebView and/or has the capability to execute javascript or any other language provided by any network available resource I'd like to ad
by patcheudor 11y ago
For mobile apps that use WebView and/or has the capability to execute javascript or any other language provided by any network available resource I'd like to add:
ALWAYS USE CRYPTOGRAPHY for communication! Simply doing HTTP to HTTPS redirects is not sufficient. The origin request must be via HTTPS. Also make sure the app is properly validating the HTTPS connection.
Sorry I had to shout, but I'm growing tired of downloading the latest cool app that is marketed as secure only to find that it doesn't use HTTPS and as a result I can hijack the application UI to ask users for things like their password, credit-card number, etc., all without them having any way to tell if they are being asked by some bad guy.