Security interview questions

Code signing and integrity

Why does an iOS app have to be code signed before it runs? Focus on what the signature guarantees from a security point of view.

#code-signing #integrity #entitlements #provisioning

Keychain accessibility

You want a Keychain item that never moves to another device through a backup restore and can only be read while the device is unlocked. Which kSecAttrAccessibl…

#keychain #accessibility #backup

Jailbroken devices

What does your app lose on a jailbroken device?

#jailbreak #threat-model #policy

Hardcoded secrets

Which statement about the security problem in this code from an iOS app's source is most accurate? …

#api-key #secrets #hardcoding

SecurityShort answerIntro카카오

Cryptography basics

In cryptography, when do you use symmetric keys, asymmetric keys, and hashes?

#cryptokit #aes #rsa #hash

What HTTPS covers

If an app does all its communication over HTTPS, which of these is not guaranteed by that alone?

#https #tls #threat-model

App Transport Security

A legacy partner API still supports only HTTP, so your app's requests fail. What is ATS, the policy blocking them?

#ats #https #tls #info-plist

Certificate pinning

An app pins by hardcoding the SHA-256 hash of the leaf certificate. What happens first when the server renews that certificate?

#ssl-pinning #rotation

Biometric authentication

This code sets isUnlocked = true when Face ID succeeds and opens the transfer screen. What's the security weakness in this approach? …

#localauthentication #faceid #touchid #biometrics

Jailbreak detection

Which heuristics are actually used to guess whether a device is jailbroken? Pick all that apply.

#jailbreak #detection

CryptoKit AEAD

Which CryptoKit APIs are AEAD, encrypting and detecting tampering at the same time? Pick all that apply.

#cryptokit #aead #aes-gcm #chachapoly

Hiding the screen

QA reports that the balance is still visible in the app switcher after you leave the account screen for the home screen. How do you handle it?

#snapshot #app-switcher #screenshot #screen-recording

WKWebView bridge

You built a bridge with WKScriptMessageHandler so a web page can call native functions, such as reading a token or opening checkout. Which measures do you need…

#wkwebview #javascript-bridge #xss #webview

SecurityShort answerBasicsAppleinterview report

Security checklist

If you were writing up iOS app security best practices in priority order for a team starting a new project, what would you put in it?

#best-practices #checklist #owasp-masvs

Keychain data left behind

Someone reported a bug where a user deletes the app, reinstalls it, and gets signed in automatically with the old account. What's the cause and the standard fi…

#keychain #reinstall #logout #first-launch

SecurityMultiple choiceBasicsTencent

Hybrid encryption

Why doesn't HTTPS (TLS) encrypt all the data with the server's public key (RSA/ECC), instead exchanging a symmetric key and sending the data with a symmetric c…

#https #tls #rsa #aes

Proxies decrypting HTTPS

What conditions have to hold before a tool like Charles or Proxyman can show an app's HTTPS request bodies in the clear? Pick all that apply.

#charles #proxy #mitm #certificate

SecurityMultiple choiceBasicsPhonePe

Keychain sharing between apps

Two iOS apps want to read and write each other's Keychain data. What does that require? Pick all that apply.

#keychain #access-group #entitlements #app-group

SecurityShort answerBasics넥슨interview report

In-app purchase flow

In a mobile game, what does an in-app purchase go through from the user's tap to the item being granted on the server?

#storekit #iap #receipt #verification

SecurityMultiple choiceBasicsJPMorgan Chaseinterview report

Where credentials go

You need to keep the API token and user credentials you received after login on the device. Which storage approaches are acceptable from a security point of vi…

#keychain #credentials #token #storage

Certificate pinning

How would you implement certificate pinning (SSL pinning) on iOS?

#ssl-pinning #certificate #public-key #urlsession

Security versus convenience

In a financial app, how do you decide when a security requirement conflicts with user convenience? Say, session length, how often you re-authenticate, or block…

#fintech #ux #threat-model #session

OAuth login flow

A PR handles social login by loading the login page inside a WKWebView. Why isn't that approach recommended?

#oauth #pkce #aswebauthenticationsession #wkwebview

Token lifetime

Your app keeps the access and refresh tokens in the Keychain and refreshes when it gets a 401. How do you stop duplicate refreshes when several requests get a …

#access-token #refresh-token #keychain #401

Privacy Manifest

App Store review sent you an ITMS-91053: Missing API declaration warning. Which statements about the Privacy Manifest, Required Reason APIs, and ATT are correc…

#privacy-manifest #required-reason-api #app-tracking-transparency #privacy

Secure Enclave

Which statements about a key created with CryptoKit's SecureEnclave.P256.Signing.PrivateKey are correct? Pick all that apply.

#secure-enclave #cryptokit #private-key

Log and SDK leaks

Going through crash reports you find user emails and tokens printed straight into log messages. How would you design against personal data leaking through logg…

#logging #pii #crashlytics #analytics

SecurityShort answerAdvancedAlibaba Group

Login across sibling apps

Several apps from one company (the main app, a payments app, a cloud app) should share login state once the user signs in to any of them. How do you implement …

#keychain #access-group #session #logout

SecurityShort answerAdvancedAlibaba Group

Hijacked web pages

Users report that the campaign page you load in an in-app WKWebView shows carrier or router ads injected into it, or jumps to an unrelated site. What kind of a…

#hijacking #dns #https #wkwebview

SecurityShort answerAdvancedAlibaba Group

Session token lifetime

Your app puts the token the server returned at login into the header of every request. An interviewer asks when that token is created and when it expires, so h…

#token #session #replay #device-binding

SecurityShort answerAdvancedBaidu

Request signing

If you designed the protocol between your app and the server yourself, how would you let the server notice that the contents changed in transit? Assume you alr…

#hmac #signature #nonce #timestamp

SecurityShort answerAdvancedMeituan

Pinning and key rotation

Your app pins the server's public key, and your security policy rotates the server certificate and key on a schedule. How does the client learn the new public …

#pinning #certificate #public-key #rotation

SecurityShort answerAdvancedShopee

Limits of HTTPS

Why can't you call communication absolutely safe just because you use HTTPS, and which well-known attacks still work there?

#https #tls #attack #dns

SecurityShort answerAdvanced스노우온카드interview report

Secrets left in memory

A security audit says card numbers, passwords, and PINs stay in process memory after they're entered and processed, so they can leak through a memory dump or a…

#memory #sensitive-data #zeroing #string

SecurityShort answerAdvancedBarclaysinterview report

Layered defense for transfers

You're designing the transfer feature of an iOS banking app. Which layers of defense would you put on the client and the server to protect a single transfer re…

#security #banking #tls #keychain

SecurityShort answerAdvanced레진엔터테인먼트interview report

Verifying purchases

A webtoon app unlocks paid episodes through in-app purchase. What's wrong with a design where the client saves a "purchased" flag in UserDefaults after a succe…

#storekit #in-app-purchase #receipt #entitlement

Reverse engineering

There's a report that a competitor decompiled your app and copied the API call format and the promotion logic outright. What can you do to make reverse enginee…

#obfuscation #reverse-engineering #symbols #anti-tamper

App Attest

Bots call your API directly and clear out the coupons. How do you use App Attest so the server accepts only requests from your real App Store app?

#app-attest #devicecheck #attestation #secure-enclave

Deep link security

A feature opens the transfer screen from a deep link on the myapp://pay scheme with to=<account>&amount=<amount> parameters. What attacks does that allow?

#deep-link #universal-link #url-scheme #open-redirect

Assessing intercepted traffic

QA reports that with a Charles proxy in place they see every API request and response from your app in the clear. How do you decide whether that's a real secur…

#mitm #proxy #charles #pinning