How secure are client-side SSL certificates in mobile apps?


Jacob Marble

I want to have secure communication between my Android/iOS app and my internet access backend service, so I'm looking into HTTPS/SSL.

If I create a self-signed certificate, then put the client certificate into the application, and have the backend service ask for that client certificate, is it really safe ?

That's why I ask. It seems it is possible to "steal" the client certificate by querying the .apk. The client certificate is just a string constant, right? This means that anyone can use the client certificate to access my backend. Is the .apk (and iOS equivalent) completely opaque to prevent discovery of client certificates ?

Marquis of Lorne

The certificate is harmless. It is a private key that needs to be protected and is only as secure as the device itself, no more secure. Distributing the certificate and private key through the app just means that whoever owns the app has the key, so it doesn't provide you any security. I think you need some kind of post-installation registration step.

Related


How secure are client-side SSL certificates in mobile apps?

Jacob Marble I want to have secure communication between my Android/iOS app and my internet access backend service, so I'm looking into HTTPS/SSL. If I create a self-signed certificate, then put the client certificate into the application, and have the backend

How secure are client-side SSL certificates in mobile apps?

Jacob Marble I want to have secure communication between my Android/iOS app and my internet access backend service, so I'm looking into HTTPS/SSL. If I create a self-signed certificate, then put the client certificate into the application, and have the backend

Client-Side SSL with Intermediate Certificates

Naftuli Kay I have a self signed root certificate and an intermediate certificate signed by that root. Basically something like this: . └── master (CA) └── servant1 (CA) I have some client certificates from master->servant1certificate chain : . └── master

Client-Side SSL with Intermediate Certificates

Naftuli Kay I have a self signed root certificate and an intermediate certificate signed by that root. Basically something like this: . └── master (CA) └── servant1 (CA) I have some client certificates from master->servant1certificate chain : . └── master

How to allow specific SSL client certificates in Nginx?

Joe White Nginx ssl_client_certificateand ssl_trusted_certificatedirectives can be used to allow client certificates signed by a given authority. But how to allow specific certificates? I want to filter by certificate thumbprint or by certificate authority + c

How secure is Firebase Cloud Messaging on the client side?

Natesh Butter It is true that firebase provides client side sdk and server side admin sdk to use Firebase Cloud Messaging. What confuses me is: We include client-side initialization code in public javascript files or script tags. Does anyone not see this initi

How secure is Firebase Cloud Messaging on the client side?

Natesh Butter It is true that firebase provides client side sdk and server side admin sdk to use Firebase Cloud Messaging. What confuses me is: We include client-side initialization code in public javascript files or script tags. Does anyone not see this initi

How secure is client-side HTML sanitization?

PW Kad I've been looking at Pagedown.js lately in hopes of using mark-down on pages instead of ugly read-only textareas. I'm very cautious as it seems easy to trick a converted converter. I've seen some discussions about Angular.js and its html bindings, and h

How secure is client-side HTML sanitization?

PW Kad Lately I've been looking at Pagedown.js for the charm of using mark-down on pages instead of ugly read-only textareas. I'm very cautious as it seems easy to trick a converted converter. I've seen some discussions about Angular.js and its html bindings,

How secure is Firebase Cloud Messaging on the client side?

Natesh Butter It is true that firebase provides client side sdk and server side admin sdk to use Firebase Cloud Messaging. What confuses me is: We include client-side initialization code in public javascript files or script tags. Does anyone not see this initi

How secure is client-side HTML sanitization?

PW Kad Lately I've been looking at Pagedown.js for the charm of using mark-down on pages instead of ugly read-only textareas. I'm very cautious as it seems easy to trick a converted converter. I've seen some discussions about Angular.js and its html bindings,

Is it secure to secure connections that check SSL certificates?

silynthos I am doing an internship. Here they gave me the code of an android app that has been revised for code security by an agency and told me to change some points that are present in the documentation. Now they are concerned about information leaks becaus

Is it secure to secure connections that check SSL certificates?

silynthos I am doing an internship. Here they gave me the code for an android app that has been revised for code security by an agency and told me to change some points that are present in the documentation. Now they are concerned about information leaks becau

Are self-signed SSL certificates less secure?

Aloso I'm using a self-signed SSL certificate on the front page for the prom. I know almost everyone uses the site personally, so even if the browser shows a warning, I can assure them that the certificate is trusted. The question is: if I use this self-signed

Are self-signed SSL certificates less secure?

Aloso I'm using a self-signed SSL certificate on the front page for the prom. I know almost everyone uses the site personally, so even if the browser shows a warning, I can assure them that the certificate is trusted. The question is: if I use this self-signed

Ionic 5: How to Secure Mobile Apps with Fingerprint AIO

Le Guangbao I'm using a fingerprint AIO to secure my mobile app, but I'm a little confused as to what to do here. As far as I know, this library only exposes 2 functions isAvailable()and show(). So I try it in my project: import { FingerprintAIO, Fingerprint

How to secure client side of React + Redux + reactRouter app?

Andrey Rusev I am building a react + redux + reactRouter app. I have an api that sends me a token after login, so I can secure my api, but I have frontend routes (like dashboards) that should be secured. I have a login form that dispatches a login action. .../