Mobile App Security

Mobile app security

A mobile binary runs on hardware the attacker owns. They can decompile it, read its storage, and proxy its traffic on a rooted phone. The recurring mistakes all treat the device as trusted: secrets dropped in plain preferences, a binary that carries its own API keys, and obfuscation mistaken for a control. Build for an environment where the user may be the adversary.

Method

1. Store secrets in the hardware-backed store, not flat files. Put tokens and keys in the iOS Keychain with kSecAttrAccessibleWhenUnlockedThisDeviceOnly, or the Android Keystore, never in UserDefaults, SharedPreferences, SQLite, or a plist. Those sit in cleartext in the sandbox and in cloud backups.
2. Ship no long-lived secret in the binary. Anything compiled in falls out to strings, Hopper, or jadx. Keep API secrets server-side, hand the app short-lived tokens, and route any third-party call that needs a secret through your own backend.
3. Pin certificates only where you can rotate fast. Pin to the CA or intermediate public key rather than the leaf, and ship at least one backup pin so a cert renewal does not brick installed apps. Skip pinning when you cannot push an update quickly enough to survive an emergency key change.
4. State the ceiling on obfuscation. R8, ProGuard, or a commercial packer buys minutes to hours against a reverse engineer, not permanence. Use it to slow analysis, never as the barrier between an attacker and a value that must stay secret, since Frida reads it at runtime regardless.
5. Keep sensitive data off the OS surface. Exclude token files from iCloud and Android auto-backup, set FLAG_SECURE or blur on backgrounding so screens stay out of the app switcher and screenshots, and validate deep links and custom URL schemes as untrusted input.
6. Treat root and jailbreak detection as signal, not a gate. It helps fraud scoring and can trip a casual attacker, but any client check runs on the attacker's device and gets patched out. Enforce every trust decision on the server.

Signals

• Does pulling the app sandbox off a rooted device reveal any token in cleartext?
• Does a server cert renewal keep old installs working through a backup pin?
• Can the app still enforce authorization once root detection is bypassed?
• Do sensitive screens stay blank in the task switcher and screenshots?

Boundaries

This addresses on-device storage, transport trust, and binary hardening. It does not cover the API the app talks to (see api-security) or the flow that issues its tokens (see oauth-flows). Server-side enforcement stays the real control: the client hardens, it does not decide.