AppDevSec Android Project: https://github.com/Hexliath/M1_devsec_SA
APK can be found >> here <<
- Explain how you ensure user is the right one starting the app
The Application needs a "pin" (which is just a simple numeric password) to unlock, the default pin is "0000" but it is made to be a one time usage pin. The user has to change it's pin.
The pin is stored and never kept in cache or RAM and only it's SHA-1 hash is stored on the phone.
- How do you securely save user's data on your phone ?
The password file only stores a hash so the user can't read the real data
The database files can't be read by any non-root users as it is a Room database
- How did you hide the API url ?
The main idea behind our implementation was to store the API URL in a .so file, way harder to decipher than a classic Kotlin class from decompilation. In order to do so, we store the URL in a C++ class and we fetch it by calling a function from our Main Activity.
- Screenshots of your application