Bulletproof Android™: Practical Advice for Building Secure Apps

Man-in-the-Middle Demo

Under the simplest circumstances an Android app operates like a classic client-server app. The client is in on your phone, and the server is a remote back-end server that communicates using RESTful, or sometimes SOAP, web services.

There are times when it’s not that simple. You could be playing a game that is mostly taking place on the phone, or the app could be running almost entirely on a remote web server and you’re just viewing it through the phone. But normally it works in a client-server fashion.

If your app sends personal information to the remote server, then ideally it should be sending the data over HTTPS, using SSL encryption, to make sure nobody can see the data. But how do you know, or how do your users know, ...