“Borderline bulletproof” security for API keys

In episode 5 of my Keep in Touch podcast I shared some thoughts on how I currently think about protecting credentials, API keys, and secrets (summarised as keys for the rest of the post) for 1st and 3rd party services and APIs. This blog post is a recap of those ideas and also a call for feedback and input from you.

The risks

The problem I am talking about addressing, is related to the fact that many applications embed keys in their binaries. These keys are required to authenticate (and authorise) the app, the user, or both with remote services. These services could be public or private APIs. Similar considerations apply if these APIs are 1st party or 3rd party.

If these keys are bundled with the app, a nefarious attacker could extract them and then impersonate the developer.

It’s not my intention to teach bad actors how to execute their plans, but I do want to give a few examples of some attack vectors that could lead to sensitive information falling in the wrong hands:

  • the nightmare scenario: the attacker could run a man-in-the-middle attack by running a WiFi hotspot or could be operating one of the nodes on the internet between the device and the APIs the app connects to
  • the easier than you’d think scenario: the attacker could run an on-device proxy (such as the brilliant Charles for iOS app that I use daily for non-nefarious reasons), and monitor all traffic
  • the attacker could grab the app binary (ie. apk or ipa) and do a string search for key-like strings
    Any of the above could lead to the attacker obtaining the keys that the app uses to authenticate itself against remote servers. Once they get these keys they can start impersonating the app and its users.

The hypothesis

I believe that by not including any keys in the app’s binary and by provisioning these credentials only via a channel owned by the operating system that uses SSL pinning, the risks mentioned above can be reduced or even avoided.

SSL pinning is essential in order to prevent an attacker from inspecting the traffic between the client app and the remote endpoints.

Animated GIF showing the way keys can be securely transmitted from cloud to app to server. This flow is described in detail below

This animation attempts to illustrate the approach I am suggesting:

  1. Provision the app without any keys
  2. Attempt to detect if the app is running on a jailbroken / rooted device, and bail if that is the case
  3. Upload the necessary keys to the Trusted Cloud provided by the Host operating system (i.e. CloudKit for iOS apps) using another app (i.e. console, browser, etc)
  4. Enforce read-only access to these keys for the client app
  5. Upon (first) launch, fetch the keys from the Trusted Cloud
  6. If the keys must be stored, only store them in a keychain or in a secure enclave
  7. Use the keys to communicate with the Server using an SSL pinned connection
  8. Should the keys become compromised, they should be replaced, and the client apps should naturally fetch the new keys. For this reason, getting the new keys should not require the previous keys.

The steps above rely on the fact that the mobile OS provides a cloud service that uses SSL pinning in order to communicate to the client apps. Without it, there cannot be a secure key provisioning mechanism and the entire flow falls apart.

The checklist

Often times the security considerations come in “late” or “after the fact”. To assess the state of affairs, and to add more protection going forward, I would go over the checklist below:

  • Limit the number of people who have access to the credentials. Replace the credentials when these people leave the job.
  • Never embed the keys in the codebase
  • Never grant the build (or distribution) servers access to the keys
  • Only trust the cloud service that belongs to the platform vendor for your app (i.e. CloudKit for iOS apps, Firebase for Android apps.)
  • Avoid storing the keys anywhere (on the device) unless really necessary
  • If the keys must be stored, then the only acceptable place is the Keychain
  • Avoid bundling black-box libraries. If the libraries use networking, inspect all networking traffic
  • Do not use a 3rd party networking library unless absolutely necessary. Always check the source code of such libraries
  • Never be the largest consumer of any one technology, framework, or library
  • Only load the keys at the code level that really needs them. Do not pass them through the business layer, particularly if there are 3rd party analytics or logging libraries bundled with the app
  • Obfuscate the code and avoid obvious naming strategies for the keys
  • Check the app’s signature / hash or anything else similar that guarantees that the binary has not been tampered with
  • Be mindful of jailbroken or rooted devices but never change the code in order to support them
  • Do a quid-pro-quo vulnerability analysis with a trusted partner (make sure dinner or beer is something at stake if an issue is found)

If you have more to add to this list, I would love to hear from you!

Closing comments

I think of myself as a security minded person, but I am by no means an expert. I offer no guarantees that implementing the steps above is going to remove or prevent any security related problems for a system I have not seen before, but, based on my current knowledge, I do believe it is the closest thing to a “borderline bulletproof” approach to securing keys and credentials that native apps use.

Lastly, I sincerely hope that, if you read this and have identified a flaw in my reasoning, or if you can spot an oversight, you will share with me (ideally with a solution in tow) so I can update the article.

The free and easy way to start a Podcast

Setting up a Podcast in 2019 can be fast, free, and painless. More importantly, the distribution and maintenance of the show can be (almost) fully automated. This post covers the steps I took to launch KeepInTouch.fm together with my co-host, Todd.

MVP – Minimum Viable Podcast

  • First we decided what our show is about. Keep in Touch covers topics from two main areas: Apple/Google tech platforms, and raising kids
  • To solve the hosting and publishing of the show we set up an account on Anchor.fm
  • Lastly, we recorded and published the show

That’s could’ve been the proverbial it, but since both Todd and I are tech people, we were not satisfied, yet. Why not? Because of the details…

Past the basics

We wanted the show to have a home that we could customise, personalise. We also wanted to be able to understand and interact with our audience. To achieve this we made did a few more things:

  • We put a little effort in the show artwork, we created chapters for the shows (chapter artwork and web links when appropriate), and we collected and published thorough show notes.
  • We recorded and edited the audio outside Anchor, and only published the mastered audio. It’s not perfect but it’s definitely less *rough*.
  • We bought a domain and we set up a website: KeepInTouch.fm.
  • We set up a Twitter account: @KeepInTouchFM.
  • We set up a vanity Google Alert for our show title and website.
  • Speaking of vanity, we created a Chartable.com account to keep an eye on how the show is doing in the charts (we were #7 in the Educational Technology category at one point!).
  • We transferred the ownership of the Apple Podcasts and Spotify feeds.
  • We set up the Stitcher and TuneIn feeds ourselves.
  • We integrated the podcast RSS feed with our new website: once we publish a show, a corresponding blog post gets created (almost) auto-magically.

Some of these enhancements will be the subject of future blog posts.

Things we learned

  • Apple Podcasts took about five days to process Anchor’s request to list our show.
  • Google Podcasts approved the show almost immediately but took about two weeks to actually make it available to listeners.
  • PocketCasts picked up the show immediately (most likely due to an integration between them an Anchor).
  • Anchor didn’t seem to get the show listed in TuneIn so we had to list add show manually.
  • Anchor doesn’t actually support all the podcasting networks.
  • Hosting the show’s website on GitHub pages was straightforward but did have some limitations. We forked Jekyll-Import to add support to the Jekyll RSS importer for Podcast RSS feeds, so we needed a home on GitHub. Hosting the website itself on GitHub made sense since Git enables a simple way to publish new episodes / blog posts.

Costs

  • Hosting and publishing the show: Free.
  • Hosting the website: Free.
  • Having a custom domain name: same cost as for any other type of website.
  • Podcast recording and editing tools: Free (not really, since we decided to use our own microphones and Digital Audio Workstation).
  • Time required to record, edit, and publish the show: 1 hour for the recording, 4 hours for editing (takes less and less each time), 30 minutes for packaging and publishing.

We are four episodes in, and we are having a lot of fun. I hope you will give our show a listen and let us know what you think. Keep in touch by subscribing on Apple Podcasts or Google Podcasts.

#Jafac picture

#JAFAC – Don’t Miss It Next Time

I had the privilege to speak at the very first edition of #JAFAC hosted at the fantastic GRIDAKL. Many people requested that speakers share their slide decks. Since there’s nothing sensitive in mine, I’m able to post it below.

During the interactive part of the talk I mentioned a number of apps. Some these (iOS) apps were: Air NZ, Amazon, Chirp, Drafts, Emoji++, Evernote, Garageband, IMDb, Instagram, Instapaper, Kibo, MacID, Musixmatch, OmniFocus, Overcast, Slack, Starbucks, Trello, Way2Ride, Workflow, and Trade Me.

I didn’t know what to expect when I was invited to take part in this event. I have a lot of respect for the people who put it together, so I went. This tweet right after the conference pretty much sums up my experience:

I came back reassured, inspired, and motivated. Thanks Sandy, Brenda, David, Steph, Jimmy, Christine, Te Miha, Richard, Colart, and everyone else I had the pleasure to listen and to talk to.

It was also very impressive to see just how knowledgeable were all the people in the attendance. Day two, the un-conference, enabled all of them to play a more active part and turned into such a revelation.

Stephanie BySouth

“Coaching Leaders” session with Stephanie BySouth. Part of un-conference on day two

If you focus on enabling people to work together successfully, if you are all about empowering teams, if you are keen to find ways to remove needless processes, if you want to learn on how to use feedback properly, if you desire to be in the company of really smart (Agile) people, then trust me, you don’t want to miss the next edition. In the mean time, I’ll leave you with a quote from Sandy: “no pain, no Spain”.

Testing is organised skepticism

You can let all the different types of software testing scare you out of your pants or you can look at the funny side of testing.

These quotes could be a starting point… I shared them with the amazing Android folks here in Wellington as part of the fourth edition of our Android Meetup.

Thanks to the lovely people at Powershop for hosting the evening, for the food, and for making this happen.

 

Thoughts on Notifications

Last Friday I was invited by the friendly people at Springload to give a talk on Push / Interactive Notifications.

The slides are targeted at Product people who are responsible with making the decision of including Push Notifications in the roadmap of their apps.

The gist of that talk is that just because you can send Push Notifications or display alerts to the user, it doesn’t mean you should. Notifications are the number one reason why people delete apps and you should keep this in mind when building your apps.

Here’s my (current) Top 10 Notification best practices:

  1. Guided “Opt In” rather than “Opt Out”
  2. Allow user to specify the types of messages they wish to receive. Support DND. Think Time Zone
  3. High volume of Notifications? Consider providing a “Snooze” custom action
  4. Only send relevant messages. This is NOT a direct marketing channel
  5. Don’t send confidential or sensitive data through push notifications
  6. Consider promoting custom actions that do not require the app to start up
  7. Use clear language and keep the message short
  8. Choose the lowest frequency of notifications that still delivers a great user experience
  9. Be aware of context. Is the user in your app right now?
  10. Consider aggregating multiple messages into a more generic “group”