5 Amazing Ways To Secure Communication On Android

With the advancement in technologies, app development has become easier.

All these emerging technologies and innovations have played a significant role in rapid application development. But, with all these benefits, there’s a prime disadvantage, and that is related to the security issues.
In recent times, app developers have to deal with a lot of stuff regarding security. Security has been a major concern for mobile app developers in the last few years. It has given them plenty of headache & sleepless nights. So, it becomes essential for the developers to get rid of this issue.
Taking this scenario into consideration, we have decided to write this blog. In this blog, we will provide you with various methods which will help you to secure communication on Android. So, why wait for anything special to happen? Let’s get straight into the thick of things, right now.!

Ways To Secure Communication On Android

Updating Crypto Providers

If you want to update the crypto providers, you need to make use of Google Play Services. For that purpose, add the following line of code in the module file of build.gradle.

Code Snippet

The SafetyNet API has plenty of features. It comprises Safe Browsing API which will check the URLs and verify if anyone of that has been marked as a threat or not. In addition to that, there’s also a reCAPTCHA API. It protects the app from malicious activities and spammers.
After synchronizing Gradle, you should call the ProviderInstaller's installIfNeededAsync method.

Code Snippet

The onProviderInstalled() method gets called when there’s a successful update in the provider. Otherwise, onProviderInstallFailed(int errorCode, Intent recoveryIntent) gets called.

Certificate and Public Key Pinning

Whenever you make an HTTPS connection with the server, the server presents you with a digital certificate. It gets validated by the Android ecosystem for making sure that connection is secure.
The certificate gets signed by the intermediate authority. Now, the certificate used by intermediate authority may get signed by another intermediate authority. So, it’s a chain process.
The chain is valid until the certificate signed by root authority gets validation from Android. Otherwise, the connection will get unsecured. So, this system is not foolproof.
That’s where the role of Certificate Pinning comes into the picture. It checks the server’s certificate against the expected certificate.
For implementing pinning facility on Android N & higher, you need to add a hash of the certificate in the network_security_config.xml file.

Code Snippet

For finding pins for a particular site, you can opt for SSL Labs.
Now, enter the site & click on the submit button. It will seal the deal for you.

Making Use Of HTTPS

Over the years, the question has been, How to fight the security threats? That’s where the role of HTTPS comes into the picture for both Android & iOS app. Many major websites have adopted this change. Enterprise Mobility Security guidelines also encourage this trend.
Whenever you’re developing an application, the focus should be on securing the network. That’s where HTTPS comes into the picture. HTTPS is a protocol that will help you to encrypt the traffic. So, an outsider won’t be able to access any data with ease. Keeping that in mind is vital.
Now, when it comes to the Android ecosystem, migration from HTTP to HTTPs is easy. For that purpose, you need to utilize the following piece of code.

Code Snippet

For version Android N & higher, you can use the Network Security Configuration of Android. In Android Studio, select app/res/xml directory. Now, create an XML directory. After that, select the directory and click File > New File. Name the file as network_security_config.xml.
Once you’re done with all the process, add the following line of code to the network_security_config.xml file.

Code Snippet

Now, the only thing remaining is telling the Android ecosystem to use this file. For that purpose, you need to add the name of the file in the application tag of AndroidManifest.xml file.

Code Snippet

Sanitization & Validation

If you implement any of the above tricks, you will be able to secure the network. But, you should also care about programming validation. You can’t put blind trust on the network data.
For this purpose, follow good programming practice - “Design By Contract.” For example, if your server expecting a string of 48 characters or less, make sure interface support this aspect.

Code Snippet

The same applies to the case of sending data to the server. You can’t blindly send the data. As a mobile app developer, you can limit the characters. It will prevent the SQL Injection scenario.
For example, you can strip the quote, semicolon, or slash when it’s not essential for user input.

Code Snippet

An excellent example of this is email validation.

Code Snippet

You can also check for the file as well. If you’re sending a photo to the server, you can also validate it. For that purpose, you can use the following coding snippet.

Code Snippet

Communication With Other Apps

So far, we have put emphasis on securing communication from/to device. But, it’s also essential to protect IPC as well. For that purpose, you can make use of Intents. One can send the data using an Intent, as shown below in the coding snippet.

Code Snippet

For broadcasting data, you should only use apps signed with the signing key. Otherwise, there can be a significant issue. Before dealing with this issue, you should have an idea of the app development technicalities. That’s where knowing the basics are essential.
For getting rid of this issue, you can use permission while sending or receiving any broadcasts where a signature is used for protectionLevel.
One can define the custom permission, as shown in the coding snippet below.

Code Snippet

After that, you can grant the permission.

Code Snippet

Now, you can send the broadcast using the following code.

Code Snippet

Conclusion

Nowadays, there is a lot of importance given to the security aspect of mobile app development. The same applies to the case of the Android ecosystem where security is a prime issue.
Taking this idea into consideration, here we have tried to provide you with a list of ways through which you will be able to secure communication on the Android ecosystem, with the utmost ease.
If you’ve any question or suggestion related to this blog, then feel free to ask them in the comment section. We’ll try to respond to each of your queries. Thank You.!