Skip to content

Mobile Security & MFA

Design to OWASP MASVS v2.1.0 / MASTG and the OWASP Mobile Top 10 2024.

Standards & compliance

  • MASVS v2.1.0 (released Jan 18, 2024) adds MASVS-PRIVACY; eight control groups (24 requirements): STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, RESILIENCE, PRIVACY, verified via MASTG. From v2.0.0 the standard "does not contain verification levels … replaced by MAS Testing Profiles" — so RFP language asking for "MASVS Level 2" is stale framing.
  • Mobile Top 10 2024 (first major revision since 2016): M1 Improper Credential Usage (now #1 — hardcoded API keys/secrets in APKs/IPAs), M2 Inadequate Supply Chain Security, M3 Insecure Authentication/Authorization, M4 Insufficient Input/Output Validation, M5 Insecure Communication, M6 Inadequate Privacy Controls, M7 Insufficient Binary Protections, M8 Security Misconfiguration, M9 Insecure Data Storage, M10 Insufficient Cryptography.

Secure storage (hardware-backed everywhere)

  • iOS: Keychain accessibility — use kSecAttrAccessibleWhenUnlockedThisDeviceOnly for non-syncable secrets; .biometryCurrentSet invalidates keys on biometric-enrollment change; Secure Enclave for non-exportable private keys; NSFileProtection for files.
  • Android: Keystore TEE vs StrongBox (API 28+, dedicated SE) with key attestation; verify isInsideSecureHardware().
  • Both: SQLCipher; biometric-bound keys via LAContext (iOS) / BiometricPrompt.CryptoObject (Android).
  • Root/jailbreak detection + attestation: Play Integrity API (replaced SafetyNet) on Android; App Attest / DeviceCheck on iOS.

Secure communications

  • Enforce TLS 1.3.
  • OAuth 2.0 Authorization Code + PKCE (RFC 7636) per RFC 8252: external browser/AppAuth (no embedded WebView), PKCE mandatory, implicit flow prohibited. mTLS for high-assurance calls. JWT refresh-token rotation with reuse detection.
  • Certificate pinning — pin public keys (SPKI SHA-256), not certificates, and always keep a backup pin:
  • Android: OkHttp CertificatePinner (custom OkHttpClientFactory on OkHttpClientProvider) or TrustKit; plus Network Security Configuration.
  • iOS: TrustKit (kTSKPublicKeyHashes, requires primary + backup pin); plus ATS.
  • RN: react-native-ssl-public-key-pinning wraps both.

Binary / runtime protection

Android R8/ProGuard (or commercial DexGuard) obfuscation; iOS strip debug symbols + compiler hardening; signature/integrity checks; Frida/debugger detection (RASP); FLAG_SECURE (Android) and screen-capture detection (iOS) to block screenshots; clipboard restrictions.

Security testing in CI

Wire MobSF (static/dynamic) into CI to fail builds on MASVS-CRYPTO/STORAGE violations; Drozer, objection/Frida for deeper testing.

Privacy

GDPR (consent, data minimization, right to deletion), CCPA, Apple Privacy Nutrition Labels, Android Privacy Dashboard (12+), App Tracking Transparency (iOS 14.5+), Microsoft Purview for enterprise data classification.

MFA on mobile

  • FIDO2/WebAuthn platform authenticators & passkeys (phishing-resistant, bound to the RP ID; private key never leaves the device):
  • iOS: AuthenticationServices + AASA associated domains + iCloud Keychain sync.
  • Android: Credential Manager API (unified passkeys/passwords/federated; third-party providers on Android 14+) + Digital Asset Links.
  • TOTP (RFC 6238); push MFA via Microsoft Authenticator with number matching; SMS OTP is discouraged (SIM-swap/SS7; NIST SP 800-63B restricts it).
  • Entra ID MFA via MSAL + Conditional Access; Entra External ID (B2C) flows for RN; step-up auth for high-risk operations (MASVS-AUTH "additional authentication"); OAuth Device Authorization Grant (RFC 8628) for constrained devices.
  • Silent SSO via the MSAL broker — Authenticator holds the PRT in Secure Enclave / hardware-backed Keystore (iOS uses URL-scheme IPC; Android uses the broker within the Work Profile). Multi-account support via Intune multi-identity.

Plugin: mobile-development · View SKILL.md on GitHub