Firebase Auth’s default password reset app is insecure, as it allows users to enter insecure passwords. My project provides a drop-in replacement. — My previous blog described how Firebase’s password reset system is insecure. This blog introduces a new open-source project which acts as a drop-in replacement for the insecure system. The problem applies to apps using email/password authentication in Firebase Auth. …

In my previous security breakdown of Firebase Auth, I noted six separate security problems, and the first on the list was its insecure password policy. Particularly, the server has almost no password complexity rules so developers are forced to implement them in their apps, which is less secure. But it…

Saving user credentials has traditionally been a bit hit-and-miss in Android, but a new library released earlier this month looks like a promising way to address that. What we want is straightforward: A way of saving a user’s username/password (or other credential) on registration or first sign in A one-tap…

Android has a security weakness that we’ve known about for years. Since, in fact, its very early versions. It’s taken until this year’s release — Android 14, which has just been released to developers — to build the architecture needed for a solution. And development has no doubt been boosted…

As we saw previously, the data your app stores to external storage can be read by other apps if they have the right permissions. Extra encryption, therefore, is essential for private data.¹ Data stored to internal storage is better protected using scoped storage. But under some circumstances, even that isn’t…

Android’s new(ish) Photo Picker is a secure, straightforward way of allowing users to pick photos and/or videos from their library. This article explains its benefits and shows how to use it with Kotlin + Compose. Here’s the GitHub link for the code in this article: https://github.com/tdcolvin/PhotoPickerDemo

Apps can benefit from knowing what kind of network they’re connected to, for example to enable certain features that require the bandwidth and low latency that 5G provides. Likewise, expectation can be set for slower load times if only 2G or 3G are available. Our friend here is the TelephonyManager…

Updated 6 Feb 2023 Android devs have the option of internal vs external storage when saving files. Whilst there’s a historical reason for this, the difference nowadays is a bit confusing. Let’s go on a journey to understand why these options exist, which option you should go for, and what…

Updated 2 February 2023 Developers’ training teaches us how to write efficient code. We learn how to minimise UI redraws, how to avoid duplicating structures in memory, and why it’s better to sort an array using Quicksort than Bubble Sort. A good developer, therefore, writes efficient code. But if you…