What is different on a device.
WHAT TO ASSUME
The device may be compromised or rooted The application binary can be inspected and modified Network traffic can be intercepted Anything stored on device can potentially be read
WHAT THAT MEANS
The client cannot be trusted, ever.
WHAT FOLLOWS
Every authorisation decision belongs on the server Business rules enforced client-side are advisory only Prices, balances and permissions are never determined by the client
WHAT THE COMMONEST SERIOUS FAULT IS
Trusting values the client sends.
WHAT TO NEVER EMBED IN AN APPLICATION
API secrets Private keys Database credentials Anything that would be damaging if extracted
WHY
Applications are decompiled routinely, and extracting strings is trivial.
WHAT TO DO INSTEAD
Route anything requiring a secret through your own server.
WHAT OBFUSCATION PROVIDES
Delay, not protection.
WHAT TO ENABLE REGARDLESS
Code shrinking and obfuscation, since it raises the effort required.
WHAT TO PROTECT WITH THE PLATFORM
Credentials, in secure hardware-backed storage.
