Ed Holloway-George 🍝

Google Dev Expert for Android

🔗

[Ed Holloway-George 🍝 @Sp4ghettiCode]

🤫 We all have secrets, and some are certainly better kept that way!

In my latest blog post, I discuss how to keep your app's secrets, just that - a secret

https://t.co/9dNTKyDCQc

#AndroidDev #MobileSec

[Ed Holloway-George 🍝 @Sp4ghettiCode]

@okmanideep 😅 No idea, never used one. Do they ship with Play Services? If not, probably safe to assume any apps on them may need to be updated

[Ed Holloway-George 🍝 @Sp4ghettiCode]

OkHttp version 5.5.1 and 4.12.1 are now available and patches the compromised eMudhra certificates

If you use OkHttp and support devices that do not have Google Play Services installed, you should upgrade ASAP

https://t.co/2FfGR9zEyH

[Ed Holloway-George 🍝 @Sp4ghettiCode]

🚨 If you use OkHttp, you might want to add the following certificates to a blocklist ASAP due to a recent leak of certificate authority private keys

Thanks to Jesse Wilson for posting about this and adding the steps to mitigate

https://t.co/MFIaa1Qdof

[Ed Holloway-George 🍝 @Sp4ghettiCode]

@rahmatrasyidii AFAIK, you should be ok with pinning as you describe. However, if you can ship the patch it certainly doesn't hurt.

[Ed Holloway-George 🍝 @Sp4ghettiCode]

@ColtonIdle I would 100% still patch, yes

[Battle Programmer Yuu @netspooky]

4 son, or php daughter?

[Ed Holloway-George 🍝 @Sp4ghettiCode]

Also worth noting that Jesse mentions OkHttp will also be shipping a release asap to address this without the need for manual intervention

Will update here when that is available 👀

[Ed Holloway-George 🍝 @Sp4ghettiCode]

🚨 If you use OkHttp, you might want to add the following certificates to a blocklist ASAP due to a recent leak of certificate authority private keys

Thanks to Jesse Wilson for posting about this and adding the steps to mitigate

https://t.co/MFIaa1Qdof

[International Cyber Digest @IntCyberDigest]

‼️ BREAKING: The private keys of 8 certificates from Indian certificate authority eMudhra were compromised, Mozilla says. Firefox blocked them within 3 hours.

Each key should be a 116-digit number, but one was just 4.

Anyone can guess them and forge HTTPS certs for any website.

[Ed Holloway-George 🍝 @Sp4ghettiCode]

I recently published a non-technical blog post on how a side-project of mine recently went 'viral' within the competitive Pokémon TCG community

X-posting it here in case anyone is interested!
https://t.co/cIw7MnOfTK

[Simona Milanović @anomisSi]

🚀 Lots of handy Android CLI updates this week!

Device Streaming is now in CLI - agents can now spin up remote devices 📱

Fresh new batch of Android skills for Security, Identity, Media3, TV, and more 😌

Learn more in ⬇️ 🤙 :
https://t.co/uLQ78lRq44

https://t.co/IAhaz7O1gj

[Ed Holloway-George 🍝 @Sp4ghettiCode]

Spoke to some Android 'old-heads' at the recent Droidcon, and it's super interesting to me to see some of them starting to explore other industries/technologies

Is it AI's fault? Has the Android dev bubble burst? Are we all just "getting old"?

I honestly have no idea

[Ed Holloway-George 🍝 @Sp4ghettiCode]

@No_Wham Totally fair

[Ed Holloway-George 🍝 @Sp4ghettiCode]

Pro-tip, don't make DNS changes while on conference WiFi 😂

[Ed Holloway-George 🍝 @Sp4ghettiCode]

@No_Wham 😂 I highly doubt it, was a bit dodgy most of today

[Ed Holloway-George 🍝 @Sp4ghettiCode]

Obviously a little biased, but 23 unique tracks of talks from industry leaders is a pretty insane offering from a conference at that price point imo

For what it's worth Berlin remains my absolute favourite droidcon event. So glad to have been a part of it once again 😊

[Nirmal Jeffrey @NirmalJeffrey]

Pretty disappointed with @nextappdevcon Berlin. Coffee isn’t even included and a croissant costs €5. The food stalls are expensive as fuck. At a paid conference, I’d expect at least basic refreshments to be covered. what are we even getting for 359€ ticket.Never coming again 👎

[Ed Holloway-George 🍝 @Sp4ghettiCode]

Starting in droidcon 2 in roughly five or so minutes 🤠

[Guardsquare @Guardsquare]

Nextapp devcon is live! 🎉

The Guardsquare team is ready to talk all things mobile application security.

🎤 Catch Blend Hamiti’s talk on securing app secrets using hardware-backed cryptography and the Android Keystore.

📍 Booth #20: Chat with our technical team

[Ed Holloway-George 🍝 @Sp4ghettiCode]

Probably two of the most interesting slides I've seen in a keynote in a long long time

#nextapp26 #droidConBerlin26

[Ed Holloway-George 🍝 @Sp4ghettiCode]

Just made it to @nextappdevcon 🎉

[Dexerto @Dexerto]

ASOS users have been sent a threatening notification claiming the clothing store's data is “fully compromised”

The message says they'll leak data unless ASOS responds