mobile-security-notes
Android mobile-security building blocks with writeups: Keystore-backed encryption, BiometricPrompt + CryptoObject, log/PII redaction, certificate pinning, HMAC signed deep links.
KotlinKeystoreBiometricsHMAC
High-level design
A library plus the threat-model writeups explaining why each piece exists.
Keystore AES-GCM
hardware-backed key storage, no key material in app memory longer than needed
↓
BiometricPrompt + CryptoObject
biometric auth bound to the actual crypto operation, not just a yes/no gate
↓
redaction
deny-by-shape — logs are redacted by structure, not a maintained blocklist of field names
↓
signed deep links
HMAC-SHA256 over the raw deep link, constant-time compare, staged strictMode rollout (VAPT CWE-472)
Low-level design
8 tests, plus a written threat model.
- –Redaction is deny-by-shape: anything matching a PII-shaped pattern is redacted by default; an allowlist opts fields back in
- –A certificate pinning failure is a hard stop, not a warning log