Quantcast
Channel: Android Security.guru » https
Viewing all articles
Browse latest Browse all 3

Check For Security Exceptions

$
0
0

This is a common flaw in apps. Trap security errors, particularly those related to SSL.

In simple terms think of SSL errors as the same as the padlock in a normal web browser. Apps don’t have a padlock and as such it’s possible for the code to ignore certificate related errors and not notify the user.

It’s common for developers to have to develop against a test or pre-release server with incorrect, absent or self-signed certificates. The developer removes security exception checking so the development code can run but it never gets put back in again.

If you need to disable security exception checking during development then use something like BuildConfig.DEBUG to ensure it only occurs in debug and not release code.

References

Viewing all articles
Browse latest Browse all 3

Latest Images

Trending Articles





Latest Images