Lesson 6 of 6 · 9 min read
Trusting a Mobile Client: Pinning, Tamper Detection and Attestation
Mobile client controls have different trust assumptions. Pinning narrows accepted TLS keys on an uncompromised client; root detection and anti-tamper checks raise effort but can be modified by an attacker who controls the app. Play Integrity and App Attest provide evidence that the server can verify and bind to an action, using different protocols. Good designs check request binding and freshness, combine attestation with fraud signals, and enforce authorization on the server. Hardware-backed keys and platform isolation remain useful within their own threat models.
free sign-in, no card required
Practise it as an interviewer asks it
Compare the Android and iOS security models. What does each platform guarantee an app, and what does it not?How does the Android application sandbox work, and what role do app signing and permissions play?What are OWASP MASVS and MASTG, and how would you use them to scope a mobile app assessment?How should a mobile app store tokens and keys on Android and iOS, and what does hardware-backed storage really protect?What are exported components on Android, and how do insecure intents and content providers lead to vulnerabilities?How can deep links and custom URL schemes be hijacked or abused, and how do verified app links fix it?