Posts about


Unintentional Unpinning with Firebase

August 28, 2017

Google's Firebase provides comprehensive set of analytics services for developers to integrate with their apps. On Android the basic functionality is enabled simply by integrating the desired plugins. No code changes required. Read Full Story

The Problem with Pinning

July 13, 2017

Certificate or Public Key Pinning is an extension to TLS that is highly effective for bot mitigation by protecting the HTTPS connection between your app and API from snooping by third parties (otherwise known as a Man in the Middle attack). The technique makes use of the TLS protocol which requires the server to provide a certificate containing its public key. If the client has a copy of the expected certificate (or just the public key) and checks for a match before completing the TLS handshake then the client is considered pinned to the server. Read Full Story

Help Your Mobile API Ecosystem to Flourish

July 5, 2017

(Image via Read Full Story

Hands on Mobile API Security: Pinning Client Connections

May 31, 2017

Add TLS and Certificate Pinning While Removing Client Secrets Read Full Story

Hands on Mobile API Security - Using a Proxy to Protect API Keys

May 11, 2017

(UGC 12591: The Fastest Rotating Galaxy Known. Image Credit:NASA,ESA, Hubble) Read Full Story

Digital Healthcare: MU3 and API Security

March 10, 2017

There is a revolution underway in healthcare in the USA. At its heart is MU3, Meaningful Use Stage 3 of the Electronic Health Record incentive program. One of the goals of this program is to empower patients and give them greater access to their medical records. Healthcare providers will have a legal responsibility to allow patients to access their data and they also have a responsibility to ensure the security of the data they provide. They have to walk a fine line between ease of access and security, and they have to do it by 2018. Read Full Story

API Lockdown Without the Lockout

December 6, 2016

When retrofitting an API change to an app which already has an existing install base care must be taken to handle the transition with minimal disruption to customers. Read Full Story