177
edits
B2G App Security Model/Threat Model: Difference between revisions
→Potential Countermeasures
| Line 63: | Line 63: | ||
====Potential Countermeasures==== | ====Potential Countermeasures==== | ||
* Controls are largely the same as for vulnerable web applications - see above. | * Controls are largely the same as for vulnerable web applications - see above. | ||
* Code Signing is an effective control here (assuming | * Code Signing is an effective control here (assuming that dynamic code loading and running - e.g. eval or script injection - is not permitted). Signing with a key not stored on the hosting server so that compromise of the server doesn’t directly result compromised phones. | ||
=== App Store Compromise=== | === App Store Compromise=== | ||