OWASP M5 Explained: Why HTTPS Alone Does Not Secure Mobile App Traffic

·1 views

The fifth entry in OWASP's Mobile Top 10 2024 list, M5: Insecure Communication, warns that simply using HTTPS is not enough to protect mobile app data in transit. The risk covers all communication channels a mobile device may use, including Bluetooth, NFC, SMS, WiFi, and TCP/IP, not just web traffic. Developers must also ensure correct TLS configuration, consistent endpoint security, and scrutinize third-party SDKs and WebViews that may silently transmit data over plaintext connections. In frameworks like React Native, the network layer spans JavaScript code, platform-level settings, and native modules, meaning a misconfiguration in any one layer can expose the entire app. OWASP rates M5 as easy to exploit, since an attacker on the same network with a basic proxy tool can intercept improperly secured traffic without advanced techniques.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Google Gemini Adds Third-Party App Connections for Bookings, Tasks and More

Google has announced a phased expansion of connected apps for its Gemini assistant, enabling users to plan, create, and complete tasks across third-party services from a single conversational interface. Named partners span productivity tools such as Granola and Otter.ai, booking platforms including OpenTable UK and Zocdoc, entertainment services like Ticketmaster, and music apps such as Pandora and iHeartRadio. The rollout is gradual and regional, meaning not all integrations will be available to every user simultaneously. Google has confirmed the partner list and broad categories but has not disclosed full availability details, activation steps, or whether linked services require separate paid subscriptions. The update represents a broader expansion of Gemini's connected-app ecosystem rather than a new AI model capability or end-to-end automation framework.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Waymo Adds Gemini AI Assistant to Ojai Robotaxis as a Rider-Only Feature

Waymo has launched a beta in-car conversational assistant called Gemini in Waymo, available to riders through a dedicated icon on the cabin screen. The feature allows passengers to use voice and natural language to adjust cabin settings, ask journey-related questions, and query general information about nearby places. Crucially, Gemini operates entirely separately from the Waymo Driver autonomous system and has no influence over driving decisions. The assistant remains inactive by default and only engages when a rider deliberately initiates an interaction, limiting its access to real-time trip data. Waymo framed the rollout, announced in July and updated in August, as part of a broader effort to enhance the in-cabin passenger experience rather than expand autonomous driving capabilities.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DIY Smart Garden Irrigation System Built for Under £10 Per Zone

A mechanical engineer has shared a detailed guide for building a modular, automated home garden irrigation system at a cost of under £10 per zone. The project was motivated by the tedious task of hand-watering vegetables and flowers during hot summers, and a desire to apply home automation technology. The system uses 12V solenoid valves, a fused 12V power supply, and a Wi-Fi smart relay to control water flow across multiple garden zones. Components were sourced primarily from AliExpress and are designed to be modular and easily replaceable. The builder notes future plans to migrate control to an ESP32 with Home Assistant integration, removing the dependency on an internet connection.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

BlocSignal 1.1.0 Lets Flutter Devs Drop FutureBuilder With One Method Call

The bloc_signals 1.1.0 library introduces universal adapter extensions that let Flutter developers convert any Dart Future, Stream, or Signal into a synchronous BlocSignalBase container using a single method call. The update aims to eliminate the architectural friction that historically made FutureBuilder and StreamBuilder the default choice for handling async data inside widget trees. Two adapter methods are provided: .toBlocSignal() for raw domain values and .toAsyncBlocSignal() for full lifecycle state tracking covering loading, data, and error phases. The library's author has long argued that placing asynchronous builders directly in Flutter's build() method is an anti-pattern, a concern he previously raised with the official Flutter team. With this release, migrating from in-view asynchronous builders to structured state management is intended to be a largely mechanical, low-boilerplate process.

0 comments Read more at DEV Community