android-security

Android App Security

Android gives you app sandboxing, SELinux, and a hardware-backed Keystore for free. The work is around them: keys generated with the right constraints, storage that survives a lost device, components that are not accidentally exported to every other app on the phone, and WebViews that do not hand your session to arbitrary JavaScript.

This skill is for native (Kotlin / Java) Android apps. Flutter and React Native apps inherit the same platform surface — the manifest, Keystore, network security config, exported components, and backup rules all apply identically; only the code that calls them lives behind a plugin boundary.

When to invoke

• Shipping an Android app that holds credentials, tokens, or sensitive data
• Before Play Store submission (where some checks are enforced; most are not)
• After a mobile-app security advisory affecting your stack
• Reviewing a third-party SDK before integration
• Investigating an in-the-wild abuse report on a mobile app

Android Keystore — generate keys the OS will defend

Keystore keys are generated inside (and never leave) a hardware-backed environment on modern devices. Use it for the key that encrypts everything else — never hardcode or derive keys in app code.

import android.security.keystore.KeyGenParameterSpec
import android.security.keystore.KeyProperties
import javax.crypto.KeyGenerator

val spec = KeyGenParameterSpec.Builder(
    "vault_master_key",
    KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
)
    .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
    .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
    .setKeySize(256)
    // Require the user to have authenticated recently to use this key:
    .setUserAuthenticationRequired(true)
    .setUserAuthenticationParameters(30, KeyProperties.AUTH_BIOMETRIC_STRONG or KeyProperties.AUTH_DEVICE_CREDENTIAL)
    // Invalidate the key if the user enrolls a new fingerprint/face:
    .setInvalidatedByBiometricEnrollment(true)
    // Prefer the dedicated secure element where available:
    .setIsStrongBoxBacked(true)
    .build()

val generator = KeyGenerator.getInstance(
    KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore"
)
generator.init(spec)
generator.generateKey()