App Security

If you’ve ever entered a password, paid online, or chatted on WhatsApp, you’ve already used cryptography — whether you knew it or not.
 It’s the invisible lock protecting your private information from hackers and eavesdroppers.

In this beginner-friendly guide, you’ll learn what cryptography is, how it works, and see a Kotlin example in action.
 No complex math — just a clear explanation you can actually understand.

What Is Cryptography?

Cryptography is the science of securing information so only the intended people can read it.
 Think of it as putting your message in a sealed envelope, but one that only the right person has the key to open.

The term comes from the Greek words:

• kryptos — hidden
• graphein — writing

Put together: hidden writing.

Why Is Cryptography Important?

Without cryptography, sending data online would be like shouting your secrets in a crowded room.
 Here’s where it plays a role every day:

• Online banking: Keeps credit card and transaction data safe.
• Messaging apps: WhatsApp, Signal, and Telegram use strong end-to-end encryption.
• Passwords: Stored securely so hackers can’t read them.
• Data privacy: Protects personal files, medical records, and government documents.

The Core Principles of Cryptography

1. Confidentiality — Only the intended person can read the message.
2. Integrity — Ensures the message isn’t altered along the way.
3. Authentication — Confirms the identity of sender and receiver.
4. Non-repudiation — Prevents someone from denying they sent a message.

How Does Cryptography Work?

At a basic level, cryptography takes:

• Plaintext — normal readable data
• Key — a secret or public piece of information
• Encryption algorithm — a method to scramble the plaintext

It turns plaintext into ciphertext (scrambled text).
 Only someone with the correct key can reverse the process through decryption.

Two Main Types of Cryptography

1. Symmetric Key Cryptography

• Same key for encryption and decryption.
• Faster but needs secure key sharing.
• Example: AES (Advanced Encryption Standard).

2. Asymmetric Key Cryptography

• Two keys: public (to encrypt) and private (to decrypt).
• You can share the public key openly.
• Example: RSA encryption.

Kotlin Example: Caesar Cipher

Let’s write a simple Caesar Cipher in Kotlin — one of the earliest encryption methods.
 It shifts letters in the alphabet by a fixed number.

fun encrypt(text: String, shift: Int): String {
    val result = StringBuilder()

    for (char in text) {
        if (char.isLetter()) {
            val base = if (char.isUpperCase()) 'A' else 'a'
            val shifted = ((char - base + shift) % 26 + base.code).toChar()
            result.append(shifted)
        } else {
            result.append(char) // Keep spaces and punctuation unchanged
        }
    }
    return result.toString()
}

fun decrypt(text: String, shift: Int): String {
    return encrypt(text, 26 - shift) // Reverse the shift
}

fun main() {
    val message = "Hello World"
    val shiftKey = 3
    val encryptedMessage = encrypt(message, shiftKey)
    val decryptedMessage = decrypt(encryptedMessage, shiftKey)
    println("Original: $message")
    println("Encrypted: $encryptedMessage")
    println("Decrypted: $decryptedMessage")
}

How the Kotlin Code Works

encrypt() function

• Loops over each character.
• If it’s a letter, shifts it forward by the shift value.
• Keeps spaces and punctuation as they are.

decrypt() function

• Reverses the shift to get back the original message.

Example output:

Original: Hello World
Encrypted: Khoor Zruog
Decrypted: Hello World

Real-Life Uses of Cryptography

• Secure websites: HTTPS uses cryptography to protect data.
• Digital signatures: Prove a file or message is genuine.
• Blockchain: Relies on cryptographic hashing for security.

Conclusion

Cryptography is the backbone of digital security.
 It’s what keeps your passwords, bank details, and personal messages safe in a world where cyber threats are everywhere.
 While the math behind it can get deep, the basic idea is simple: scramble information so only the right person can read it.

When developing Android apps for sensitive industries like finance, security is paramount. One of the most critical aspects of securing communication between the app and the server is ensuring that TLS (Transport Layer Security) is implemented correctly. TLS is what keeps our data encrypted while being transferred over the internet, protecting users from attackers trying to intercept or tamper with the information.

In this blog, we’ll dive deep into Strong TLS Validation and how we can implement it in financial Android apps. This includes ensuring that the server we’re communicating with is legitimate and that the communication is safe and encrypted. I’ll walk you through the concept, why it’s so important, and how to integrate strong TLS validation into your Android financial app.

Let’s get started!

Why TLS Validation Matters in Financial Apps

When developing financial applications, we’re dealing with sensitive information like user credentials, financial transactions, and personal data. If an attacker can intercept or manipulate the communication between the app and the server, they could potentially steal money, data, or perform unauthorized actions. This makes it absolutely crucial to implement strong TLS validation to ensure that the communication is both confidential and authentic.

TLS ensures that the data sent from the client (our Android app) to the server is encrypted and cannot be read or altered by anyone in between. However, just encrypting the data isn’t enough. We also need to ensure that the app communicates with the right server (and not a malicious one) by verifying the server’s identity.

The Basics of TLS

Before we go into the code, let’s quickly recap what TLS does. TLS (formerly SSL) is a protocol used to secure data transmission over the internet. It ensures three key things:

1. Confidentiality – Encrypts data so that even if it’s intercepted, it’s unreadable.
2. Integrity – Ensures the data hasn’t been altered during transmission.
3. Authentication – Verifies the identity of the server (so we know we’re talking to the right server).

When we connect to a server over HTTPS (which uses TLS), the server sends its TLS certificate to prove its identity. The client (our Android app) then checks the validity of the certificate. If the certificate is valid, the communication is established securely.

But how do we ensure that the certificate is trusted and legitimate in our Android app? That’s where Strong TLS Validation comes in.

Strong TLS Validation Explaination

Strong TLS validation involves verifying the following:

1. Certificate Authenticity — Is the certificate issued by a trusted Certificate Authority (CA)?
2. Certificate Expiry — Is the certificate expired?
3. Certificate Revocation — Has the certificate been revoked by the CA?
4. Domain Validation — Does the domain match the one specified in the certificate?
5. Public Key Pinning — Is the public key of the server the same as the one expected by the app?

By performing these checks, we can ensure that the server we’re communicating with is authentic and that the connection is secure.

Implementing Strong TLS Validation in Android

Now that we understand the importance of strong TLS validation, let’s see how we can implement it in our Android financial app using Kotlin.

Enforcing HTTPS in Android

The first step in implementing TLS validation is ensuring that our app communicates over HTTPS rather than HTTP. HTTP is not encrypted, so it should never be used for sensitive communication.

In Android, we can enforce HTTPS by ensuring that all our URLs are prefixed with https://. We can also configure the app’s network security configuration to block insecure connections.

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config cleartext-traffic-permitted="false">
        <domain includeSubdomains="true">your-financial-app.com</domain>
    </domain-config>
</network-security-config>

This configuration blocks all cleartext (non-HTTPS) traffic while allowing traffic to the specified domain.

Validating Server Certificates with Custom Trust Manager

The next step is to implement certificate validation using a custom TrustManager. This is the core of our TLS validation, where we ensure that the server’s certificate is valid and trustworthy.

import android.util.Log
import java.security.cert.X509Certificate
import javax.net.ssl.X509TrustManager
import javax.net.ssl.SSLContext
import javax.net.ssl.TrustManagerFactory

class CustomTrustManager : X509TrustManager {
    override fun checkClientTrusted(chain: Array<out X509Certificate>?, authType: String?) {
        // Here, you can add additional client-side certificate validation if needed.
    }

    override fun checkServerTrusted(chain: Array<out X509Certificate>?, authType: String?) {
        // Validate the server certificate chain
        try {
            // Perform strong certificate validation here (e.g., certificate pinning, issuer validation)
            val cert = chain?.firstOrNull()
            val issuer = cert?.issuerDN?.name
            if (issuer != "CN=Your Trusted CA") {
                throw Exception("Untrusted certificate issuer: $issuer")
            }
            Log.d("TLS", "Server certificate is trusted.")
        } catch (e: Exception) {
            Log.e("TLS", "Certificate validation failed: ${e.message}")
            throw e
        }
    }

    override fun getAcceptedIssuers(): Array<X509Certificate>? {
        return null // Use default trust management for accepted issuers
    }
}

Here, we are checking the issuer of the server’s certificate. You can extend this to validate other aspects, like expiration, revocation, and more.

Configuring SSLContext

Next, we need to create an SSLContext that uses our custom TrustManager to enforce strong validation.

import javax.net.ssl.SSLContext
import javax.net.ssl.HttpsURLConnection
import java.security.NoSuchAlgorithmException
import java.security.KeyManagementException

fun setupSSLContext() {
    try {
        // Create an SSL context with our custom TrustManager
        val sslContext = SSLContext.getInstance("TLS")
        sslContext.init(null, arrayOf(CustomTrustManager()), null)

        // Set the default SSLSocketFactory to use our custom validation
        HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.socketFactory)
    } catch (e: NoSuchAlgorithmException) {
        Log.e("TLS", "Error initializing SSLContext: ${e.message}")
    } catch (e: KeyManagementException) {
        Log.e("TLS", "Error initializing SSLContext: ${e.message}")
    }
}

This setupSSLContext function initializes an SSLContext with our custom TrustManager. It ensures that any HTTPS connection made by the app will undergo strong validation based on our rules.

Using Custom SSL Pinning in Android

One of the strongest techniques for ensuring the integrity of the server’s identity is SSL pinning. SSL pinning involves hardcoding the server’s certificate or public key in the app, ensuring that the app only trusts the specified server.

import okhttp3.*
import java.security.cert.CertificateFactory
import java.io.InputStream

class CustomSSLPinningInterceptor(private val certificateInputStream: InputStream) : Interceptor {

    override fun intercept(chain: Interceptor.Chain): Response {
        // Create an SSLContext using the custom certificate
        val cf = CertificateFactory.getInstance("X.509")
        val ca = cf.generateCertificate(certificateInputStream)

        // Creating a KeyStore that contains our certificate
        val keyStore = java.security.KeyStore.getInstance("PKCS12")
        keyStore.load(null, null)
        keyStore.setCertificateEntry("ca", ca)

        // Set up the TrustManager with our certificate
        val trustManagerFactory = javax.net.ssl.TrustManagerFactory.getInstance(javax.net.ssl.TrustManagerFactory.getDefaultAlgorithm())
        trustManagerFactory.init(keyStore)

        // Create an SSLContext
        val sslContext = javax.net.ssl.SSLContext.getInstance("TLS")
        sslContext.init(null, trustManagerFactory.trustManagers, java.security.SecureRandom())

        // Create a custom OkHttpClient with our SSLContext
        val sslSocketFactory = sslContext.socketFactory
        val client = OkHttpClient.Builder()
            .sslSocketFactory(sslSocketFactory, trustManagerFactory.trustManagers[0] as javax.net.ssl.X509TrustManager)
            .hostnameVerifier { _, _ -> true }  // Disable hostname verification for custom pinning
            .build()

        return client.newCall(chain.request()).execute()
    }
}

In this code,

• We first load the certificate that we want to pin (usually obtained from the server) into a KeyStore.
• We then create a TrustManagerFactory and set it up to use our custom certificate.
• The SSLContext is configured to only trust our specified certificate for secure communication.
• The OkHttpClient is then configured to use this custom SSL context, enforcing SSL pinning.

Using the Custom SSL Pinning Interceptor

Once we’ve created the custom SSL pinning interceptor, we need to attach it to our OkHttp client.

val certificateInputStream = assets.open("my_server_certificate.crt") // Load certificate from assets
val interceptor = CustomSSLPinningInterceptor(certificateInputStream)
val okHttpClient = OkHttpClient.Builder()
    .addInterceptor(interceptor)
    .build()

// Now, use this client for your network requests
val retrofit = Retrofit.Builder()
    .baseUrl("https://your-financial-app.com")
    .client(okHttpClient)
    .addConverterFactory(GsonConverterFactory.create())
    .build()

Host Name Verification

In addition to certificate pinning, it’s also important to perform proper hostname verification to ensure the server’s identity. Android’s default SSL handling does this for you, but when implementing custom SSL pinning, you should still verify the hostname manually.

val client = OkHttpClient.Builder()
    .hostnameVerifier { hostname, session ->
        // Manually verify the server's hostname
        hostname == "your-financial-app.com"  // Replace with your expected server hostname
    }
    .build()

Handling Expired or Invalid Certificates

Another crucial part of TLS validation is handling expired or invalid certificates. In production apps, certificates may expire, so it’s important to have a strategy in place for handling these cases. One approach is to implement fallback mechanisms, like showing a user-friendly error message or redirecting to a page explaining the issue.

try {
    val response = okHttpClient.newCall(request).execute()
    if (response.isSuccessful) {
        // Handle successful response
    } else {
        // Handle server-side error
    }
} catch (e: SSLHandshakeException) {
    // Handle SSL validation failure
    showError("Security certificate is invalid or expired. Please contact support.")
}

Public Key Pinning (Optional but Recommended)

For even more security, we can use Public Key Pinning to ensure that we’re always communicating with the expected server. This involves storing the server’s public key hash in the app and verifying that it matches the one in the server’s certificate.

import okhttp3.CertificatePinner
import okhttp3.OkHttpClient

fun createPinnedClient(): OkHttpClient {
    val certificatePinner = CertificatePinner.Builder()
        .add("your-financial-app.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
        .build()

    return OkHttpClient.Builder()
        .certificatePinner(certificatePinner)
        .build()
}

This ensures that the app only connects to the server with the specified public key. If the key doesn’t match, the connection will be blocked, preventing man-in-the-middle attacks.

So, by pinning the certificate, we are making sure that our app only trusts the exact server we’ve configured. Even if a malicious attacker tries to intercept the communication by presenting a forged certificate, the app will reject the connection since the server certificate doesn’t match the one it expects.

Best Practices and Testing

• Testing: Use tools like SSL Labs to test your server’s TLS configuration.
• Stay Updated: Regularly review TLS best practices and update your implementation to address emerging threats.
• Avoid Shortcuts: Never disable TLS checks in production, even during debugging.

Conclusion

Implementing strong TLS validation in financial Android apps is crucial to ensure the security and privacy of sensitive user data. By enforcing HTTPS, using custom TrustManagers, and even implementing certificate pinning, we can significantly reduce the risk of man-in-the-middle attacks and ensure that our app communicates only with trusted servers.

Remember, security is an ongoing process, and it’s essential to stay updated with the latest security best practices. With the steps I’ve outlined here, you’ll be on your way to making your financial Android app secure and trustworthy for your users.

Secure communication is the backbone of modern financial app development. HTTPS, powered by TLS (Transport Layer Security), ensures that the data exchanged between your app and its server stays protected from unauthorized access. In this blog, we’ll explore HTTPS communication on Android, focusing on TLS 1.3—the latest and most secure version of the protocol. We’ll guide you through the process of implementing secure communication in Kotlin, simplifying each step with clear, jargon-free explanations.

What is HTTPS and TLS?

HTTPS
HTTPS (Hypertext Transfer Protocol Secure) is an upgrade to HTTP, designed to secure the communication between web clients and servers. It uses TLS (Transport Layer Security) to encrypt the data, protecting it from interception during transmission. This is especially important for safeguarding sensitive details like passwords, payment information, or personal data.

TLS
TLS is a cryptographic protocol that offers three core protections:

• Encryption: Ensures that data remains confidential and cannot be accessed by unauthorized parties.
• Authentication: Confirms that the server is legitimate and, optionally, verifies the client’s identity.
• Integrity: Guarantees that the data hasn’t been modified during transmission.

TLS 1.3
TLS 1.3, the latest version of the protocol, brings several key enhancements:

• Improved Handshake Performance: Reduces the time needed to establish a secure connection.
• Stronger Encryption: Implements more robust encryption methods for better security.
• Simplified Protocol: Strips away outdated features, reducing potential vulnerabilities.

Why HTTPS and TLS 1.3?

HTTPS
As the secure version of HTTP, HTTPS uses TLS to encrypt the data exchanged between the app and the server. In the context of financial applications, HTTPS offers:

• Confidentiality: Safeguards sensitive information like user credentials and transaction data from being intercepted.
• Data Integrity: Ensures the information sent and received is unchanged during transit.
• Server Authentication: Verifies the authenticity of the server, helping protect against fraud and man-in-the-middle attacks.

TLS 1.3
TLS 1.3, released in 2018, brings numerous advantages over previous versions:

• Stronger Security: Phases out older, vulnerable protocols such as RSA key exchange, making the connection more secure.
• Faster Handshakes: Simplifies the connection process, improving speed and reducing delay.
• Forward Secrecy: Even if an attacker gains access to a server’s private key, past communication remains secure.

For financial apps, using TLS 1.3 is essential to ensure both robust security and a smooth, responsive user experience.

Setting Up HTTPS in Android Apps

Android natively supports HTTPS, but to make sure your app works with TLS 1.3, you’ll need to configure a few settings and understand the requirements.

Prerequisites

• Make sure your app is targeting Android 10 (API level 29) or higher, as this version comes with native support for TLS 1.3.
• Install a valid SSL certificate on the server hosting your APIs to establish secure communication.

Step-by-Step Implementation

// Use the latest version in the future.
implementation("com.squareup.okhttp3:okhttp:4.12.0") 
implementation("com.google.code.gson:gson:2.12.0")

We’ll utilize OkHttp for handling HTTPS requests, as it offers a lightweight and efficient solution.

Creating a Secure HTTP Client

To enable HTTPS with TLS 1.3, configure OkHttp’s OkHttpClient. This client will handle secure communication with your backend.

import okhttp3.OkHttpClient
import okhttp3.Request
import okhttp3.Response
import java.util.concurrent.TimeUnit

fun createSecureHttpClient(): OkHttpClient {
    return OkHttpClient.Builder()
        .connectTimeout(30, TimeUnit.SECONDS)
        .readTimeout(30, TimeUnit.SECONDS)
        .writeTimeout(30, TimeUnit.SECONDS)
        .build()
}

Here,

• connectTimeout: The maximum duration allowed for establishing a connection.
• readTimeout: The maximum time allowed to wait for data after the connection is established.
• writeTimeout: The maximum time allowed to wait while sending data to the server.

With Android 10 and higher versions supporting TLS 1.3 natively, no extra configuration is needed for the protocol. The OkHttp client automatically negotiates the highest version it supports.

For older Android versions, ensure that the device is using the latest system libraries, or incorporate third-party TLS solutions such as Conscrypt to enable support for newer TLS protocols like TLS 1.2 or TLS 1.3.

Making Secure HTTPS Requests

Once the client is ready, use it to make API requests.

import okhttp3.OkHttpClient
import okhttp3.Request
import org.json.JSONObject

fun makeSecureRequest(client: OkHttpClient) {
    val request = Request.Builder()
        .url("https://yourfinancialdomain.com/api/endpoint")
        .get()
        .build()

    client.newCall(request).execute().use { response ->
        if (response.isSuccessful) {
            val jsonResponse = JSONObject(response.body?.string() ?: "")
            println("Response: $jsonResponse")
        } else {
            println("Error: ${response.code}")
        }
    }
}

• Request Building: Defines the target URL and HTTP method (GET in this case).
• Response Handling: Reads and parses the server’s response. Always handle errors to ensure reliability.

Key Points About TLS 1.3

• Backward Compatibility: TLS 1.3 supports backward compatibility with older versions (like TLS 1.2) by negotiating the highest mutually supported version.
• Performance: TLS 1.3 reduces round-trip times (RTTs) during handshakes, resulting in faster connection establishment, making it ideal for mobile apps.
• Security: TLS 1.3 deprecates weak cryptographic algorithms and only supports modern, secure encryption methods, ensuring enhanced security.

Testing HTTPS Communication

• Use Postman: Test your API endpoints, ensuring valid certificates are used and checking SSL/TLS connection aspects like certificate trust and hostname verification.
• Validate Pinning: Validate certificate pinning by changing the server’s certificate and ensuring that the client rejects untrusted connections. Ensure both server and client-side pinning implementations are correctly configured.
• Check TLS Version: Check the TLS version using tools like Wireshark, which can capture network traffic and verify if TLS 1.3 is being used, or use OpenSSL for command-line verification.

Best Practices for Secure HTTPS Communication

• Use Strong Encryption: Always enable the latest TLS protocols (preferably TLS 1.2 or 1.3) and ensure strong cipher suites are used for secure communication.
• Avoid Hardcoding Keys: Avoid hardcoding keys and sensitive data in your source code; use secure storage mechanisms like Android Keystore, EncryptedSharedPreferences, or secure servers to store such information.
• Monitor Dependencies: Monitor and regularly update libraries (e.g., OkHttp, Retrofit) to patch vulnerabilities. Use tools like Dependabot to stay up to date with security updates.
• Implement Error Handling: Implement robust error handling to manage network issues gracefully without exposing sensitive information. Provide meaningful feedback to users without revealing implementation details or errors.

Conclusion

Secure HTTPS (TLS 1.3) communication isn’t just a best practice — it’s a must for financial Android apps. With Kotlin and powerful tools like OkHttp, you can easily implement top-tier security without the hassle. By following these steps, you’ll not only protect sensitive data but also earn your users’ trust every step of the way.

Let’s secure the financial world, one app at a time..!