Securing Your Apps at Scale

Abstract

I wanted to cover some techniques that I have seen and used when protecting Android apps. I titled the chapter with the words "at scale" because when I was at GO-JEK, everything was at scale – the users, the engineering teams, the threats. As I may or may not have mentioned in my previous book, a healthy dose of paranoia will serve you well. Personally, I don't think that you as a developer stand a chance against the reverse engineers. They are always ahead, and they are always at an advantage. I think it is somewhat of a waste of time spending a disproportionate amount of time trying to secure your apps. Then all you have built is an app with 20% actual features and 80% security. No balance. It's like the engineering team that focuses so much on testing that you're devoting all your time and energy to tests and not to the code itself. I recall Zed Shaw (the creator of the Mongrel web server for Ruby web applications) once wrote about this in a scathing piece leveled at the Ruby on Rails community entitled "Rails is A Ghetto." He was mentioning a well-known software development company at the time, and he said: