Skip to content

Unsafe HTTPS use #1

@wolfmd

Description

@wolfmd

Running a security scan against the source code of this project has shown that the HTTPS used in this application has been manually overiden. Using HTTPS increases the security of credentials transmitted between the device and server as well as guaranteeing there is no middle-man attacker feeding malicious data to the user. Guides to properly implementing HTTPS can be found here: https://developer.android.com/training/articles/security-ssl.html

/blippex_android_app/blippex/src/com/blippex/app/misc/Common.java:74: Custom SSLSocketFactory used
/blippex_android_app/blippex/src/com/blippex/app/misc/Common.java:75: AllowAllHostnameVerifier used, this is not a secure connection
/blippex_android_app/blippex/src/com/blippex/app/misc/Common.java:75: Custom HostnameVerifier used; this is not safe for production use
/blippex_android_app/blippex/src/com/blippex/app/misc/MySSLSocketFactory.java:25: Custom trust manager used. Remove from production

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions