masvs

From "Google Play rolls out an "Independent security review" badge for apps" https://news.ycombinator.com/item?id=38134841 :: https://www.bleepingcomputer.com/news/security/google-play-a... : > Specifically, that standard is MASA (Mobile App Security Assessment), which was introduced last year as an initiative of the App Defense Alliance (ADA) to define a concrete set of requirements for mobile app security. > The requirements concern data storage and data privacy practices, cryptography, authentication and session management, network communication, platform interaction, and code quality. App Defense Alliance > Mobile Application Security Assessment: https://appdefensealliance.dev/masa OWASP Mobile Application Security: https://mas.owasp.org/ : > The OWASP Mobile Application Security (MAS) flagship project provides a security standard f

https://www.bleepingcomputer.com/news/security/google-play-a... : > Specifically, that standard is MASA (Mobile App Security Assessment), which was introduced last year as an initiative of the App Defense Alliance (ADA) to define a concrete set of requirements for mobile app security. > The requirements concern data storage and data privacy practices, cryptography, authentication and session management, network communication, platform interaction, and code quality. App Defense Alliance > Mobile Application Security Assessment: https://appdefensealliance.dev/masa OWASP Mobile Application Security: https://mas.owasp.org/ : > The OWASP Mobile Application Security (MAS) flagship project provides a security standard for mobile apps (OWASP MASVS) and a comprehensive testing guide (OWASP MASTG) that covers the processes, techniques, and tools

The project team of the OWASP Mobile Application Security Verification Standard (https://github.com/OWASP/owasp-masvs) is right in the middle of completely refactoring the document and it's requirements for mobile apps! We were re-visiting this topic in the last few months and tried to identify the current pain points and how they could be removed. In order to move forward we are looking for your feedback! If you would like to share any feedback or comments of what should be changed in the MASVS, please do so by participating in our Github Discussion: https://github.com/OWASP/owasp-masvs/discussions/553

Some I see are surprised to see the level of obfuscation used in the application. Many pointed, many ingredients for the obfuscation used in the app are off-the-shelf and few of them can be said to be well known in the industry, but still there is a cost in integrating them into a product. Obfuscation is notorious in breaking things which should work normally (normal compilation process) and as a own goal making it hard to debug as well. Integrating, testing, debugging and difficulty in debugging production crash logs is a considerable cost. That said, obfuscation is increasingly being used in mobile applications now. Check your banking application or some government applications, you will find obfuscation being used. With mobile applications getting richer and lot of code executing on the client side, makes it compelling case to secure a