How Secure is your Android Keystore Authentication ?

[ForgottenSeer 85179]

Introduction

Privileged malware or an attacker with physical access to an Android device is a difficult attack vector to protect against. How would your application maintain security in such a scenario?
This blog post will discuss the Android keystore mechanisms and the difficulties encountered when attempting to implement secure local authentication. By providing an introduction to the AndroidKeystore, it's API and usage you will be able to understand the common vulnerabilities associated with the keystore as they are discussed. The core of this article will highlight the developed tools which can be used to audit an application's local authentication. This will conclude with general guidance on secure implementations and an application which can be used as a reference is presented.

For full post, visit the site as the (technical) post is long:

Threats & Research Archives - F-Secure Blog

labs.f-secure.com

And if you wonder which type of Apps use this: for example the 2FA app andOTP

 

[upnorth]

GitHub - WithSecureLabs/android-keystore-audit

Contribute to WithSecureLabs/android-keystore-audit development by creating an account on GitHub.

github.com

Good source from the report. Thanks for the share.