The Mobile App Security Library

Certificate pinning is a security technique that increases secure communication over the TLS (transport layer security) protocol, like HTTPS. It ties a chosen TLS certificate or public key exclusively to the API server, allowing the application to reliably confirm the server's identity each time it connects. During interactions, the server presents a digital certificate to prove its identity and secures the encryption of data sent through APIs between the client and server. By matching the server’s shown certificate against a predetermined or "pinned" certificate within the app, certificate pinning ensures an additional layer of security, preventing man-in-the-middle (MITM) attacks and ensuring server communication integrity.

White-box cryptography is a software-based technology that merges encryption and code obfuscation to embed secret keys within application code. It aims to make the code and keys indistinguishable to an attacker, allowing the new white-box program to run safely in an insecure environment. White-box cryptography helps organizations encrypt critical portions of programs and store the keys for decryption in a tamper-proof manner.

Security posture is an organization’s overall security status and risk tolerance. It includes cybersecurity policies, controls, and technical capabilities to protect against threats. It evaluates how effectively an organization can predict, prevent, detect, and respond to cyber threats. A robust security posture addresses current threats and adapts to new vulnerabilities, ensuring comprehensive protection.

Device cloning is the unauthorized duplication of a mobile device's identity attributes used to create a copy or mimic the original device. In the scope of application security, device cloning allows malicious actors to impersonate the original device's owner, potentially leading to identity theft and fraud.