Giải Pháp Bảo Mật Ứng Dụng Di Động

1// ✅ Secure iOS implementation  
2import Security
3 
4func savePasswordSecurely(_ password: String) {
5  let keychain = Keychain(service: "com.app.credentials")
6  keychain["password"] = password
7  print("Password securely saved to Keychain")
8}
9 
10// Using iOS Keychain for secure storage
11class SecureLoginManager {
12  private let keychain = Keychain(service: "com.app.credentials")
13  
14  func storeCredentials(username: String, password: String) {
15      keychain["username"] = username
16      keychain["password"] = password
17      UserDefaults.standard.set(true, forKey: "isLoggedIn")
18  }
19}

1// ❌ Vulnerable iOS implementation
2func savePassword(_ password: String) {
3  UserDefaults.standard.set(password, forKey: "user_password")
4  print("Password saved to UserDefaults")
5}
6 
7// Storing sensitive data in UserDefaults
8class LoginManager {
9  func storeCredentials(username: String, password: String) {
10      UserDefaults.standard.set(username, forKey: "username")
11      UserDefaults.standard.set(password, forKey: "password")
12      UserDefaults.standard.set(true, forKey: "isLoggedIn")
13  }
14}

1// ✅ Secure Android implementation
2EncryptedSharedPreferences encryptedPrefs = EncryptedSharedPreferences.create(
3  "secure_prefs",
4  MasterKeys.getOrCreate(MasterKeys.AES256_GCM_SPEC),
5  this,
6  EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
7  EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
8);
9 
10// Storing sensitive data encrypted
11SharedPreferences.Editor editor = encryptedPrefs.edit();
12editor.putString("credit_card", "4532-1234-5678-9012");
13editor.putString("api_key", "sk_live_abc123def456");
14editor.putString("user_token", "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...");
15editor.apply();
16 
17// Reading encrypted data
18String creditCard = encryptedPrefs.getString("credit_card", "");

1// ❌ Vulnerable Android implementation
2SharedPreferences prefs = getSharedPreferences("app_prefs", MODE_PRIVATE);
3SharedPreferences.Editor editor = prefs.edit();
4 
5// Storing sensitive data in plain text
6editor.putString("credit_card", "4532-1234-5678-9012");
7editor.putString("ssn", "123-45-6789");
8editor.putString("api_key", "sk_live_abc123def456");
9editor.putString("user_token", "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...");
10editor.apply();
11 
12// Reading sensitive data
13String creditCard = prefs.getString("credit_card", "");
14String apiKey = prefs.getString("api_key", "");

1// ✅ Secure network implementation
2val client = OkHttpClient.Builder()
3  .certificatePinner(
4      CertificatePinner.Builder()
5          .add("api.bank.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
6          .add("api.bank.com", "sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=")
7          .build()
8  )
9  .build()
10 
11// Implementing proper certificate validation
12class SecureNetworkManager {
13  private val certificatePinner = CertificatePinner.Builder()
14      .add("*.mybank.com", "sha256/primary-cert-hash")
15      .add("*.mybank.com", "sha256/backup-cert-hash")
16      .build()
17  
18  private val client = OkHttpClient.Builder()
19      .certificatePinner(certificatePinner)
20      .connectTimeout(30, TimeUnit.SECONDS)
21      .readTimeout(30, TimeUnit.SECONDS)
22      .build()
23}

1// ❌ Vulnerable network implementation
2val client = OkHttpClient.Builder()
3  .hostnameVerifier { _, _ -> true }  // Accepts all certificates!
4  .build()
5 
6// Disabling SSL verification completely
7val trustAllCerts = arrayOf<TrustManager>(object : X509TrustManager {
8  override fun checkClientTrusted(chain: Array<X509Certificate>, authType: String) {}
9  override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String) {}
10  override fun getAcceptedIssuers(): Array<X509Certificate> = arrayOf()
11})
12 
13val sslContext = SSLContext.getInstance("SSL")
14sslContext.init(null, trustAllCerts, SecureRandom())
15 
16val client = OkHttpClient.Builder()
17  .sslSocketFactory(sslContext.socketFactory, trustAllCerts[0] as X509TrustManager)
18  .hostnameVerifier { _, _ -> true }
19  .build()