In a financial app, how do you decide when a security requirement conflicts with user convenience? Say, session length, how often you re-authenticate, or blocking screenshots.
Settle the threat model (what, from whom) and the regulatory requirements first, work the authentication strength and session policy back from each action's risk and damage, then watch drop-off and incident reduction together after the decision.
SecurityShort answerIntro
What does your app lose on a jailbroken device?
#threat-model
SecurityMultiple choiceIntro
If an app does all its communication over HTTPS, which of these is not guaranteed by that…
#threat-model
SecurityShort answerExpert
QA reports that with a Charles proxy in place they see every API request and response…
#threat-model
SecurityShort answerAdvanced
Several apps from one company (the main app, a payments app, a cloud app) should share…
#session