21How do hardware-backed keys work on Android and iOS, what does key attestation prove, and why must biometrics unlock a key, not a boolean?▼hardNewGoogleAppleJPMorgan Chase◆ premiumA key the app cannot export is only half the story. The other half is making the key usable only after the user is really present, which a hooked 'authentication succeeded' callback can fake.Open full answer →
28How do security fixes reach Android and iOS devices, and how should a banking app handle users on old OS patch levels or old app versions?▼mediumNewGoogleAppleJPMorgan Chase◆ premiumYour app can be fully patched on a phone whose kernel is two years old. The answer separates what you control, what the platform controls, and what you can only measure.Open full answer →