9 ms·

> You just install it on your phone and use the app. Some people on the cybersecurity side are starting to cry....

• user43928 7d ago
  I have been getting these comments often here, including concerns about my non existent backend's security. Last time, when I pointed out that the attack surface for mobile apps is typically very small, some users started to talk about zero day vulnerabilities in the OS's media handling, as if it was a concern for my app implementation. I found the concerns again wildly overblown.
  • joenada 6d ago
    You sound like a person who's never had their app pen tested. The attack surface is anything but small if you're working with any kind of sensitive data.
  • freeplay 7d ago
    But what if someone discovers a iOS 0day worth several million dollars and burns it to compromise your app specifically? /s
• Perz1val 7d ago
  Why? The api has to be secure. Mobile os keeps the app safe. Where is the attack surface?
  • nicce 7d ago
    You don’t believe how often people leave secrets in the app or use webviews and iframes badly, misconfigure OAuth in client side and so on. There are many issues where secure API does not help.
    • Perz1val 6d ago
      Ok, yeah, I forgot that people do ship api keys inside binaries
• chis 7d ago
  Are there cybersecurity concerns in the frontend? I would have thought you have to assume the client is untrusted and only do security work on the backend
  • nicce 7d ago
    1. Not storing secrets properly or using hardcoded secrets 2. Wild use of webviews/iframes sometimes easily propagates as XSS in phones 3. Incorrect client-side OAuth 2.0 configuration e.g. with schema-based redirect URLs. 4. Not supporting high-enough API versions, which may prevent some OS-related weaknesses 5. The list is actually very long. Just few top of my mind.
    • chis 7d ago
      Fantastic answer thank you
    • rudedogg 7d ago
      Doing anything right on web is 10x harder and more complex. The problem is the browser, once you use it to deliver anything you have to buy into all of it’s bullshit. CORS, XSS, headers, caching. All that just goes away (outside your backend API, if you even need one) when you ship a native app
    • Matumio 6d ago
      My favourite is a logout button with a logout API that fails. (Not a huge pratical concern, I admit, because it's a local attack.) Nobody ever notices because it still shows the logout screen, which hides the API error toast (if errors were even displayed). The still valid refresh token stays in sessionStorage (or even localStorage) while the app displays "logged out". (Bonus points if you cleared the access token in the error handler but not the refresh token, and on page reload you ask the user to log in again despite having a valid token.) Or a login form that gets hidden after login, but clears the username and password only when you click "login back in". (Bonus points if the backend also enforces a 5min session timeout "for security".)
    • user43928 6d ago
• Culonavirus 7d ago
  They better start a proper hydration regime because they'll be crying a lot.