Jeff Six - Application Security for the Android Platform: Processes, Permissions, and Other Safeguards

Copyright 2011 Jeff Six

OReilly books may be purchased for educational, business, or sales promotional use. Online editions are also available for most titles (.

Nutshell Handbook, the Nutshell Handbook logo, and the OReilly logo are registered trademarks of OReilly Media, Inc., Application Security for the Android Platform , the image of a red gunard, and related trade dress are trademarks of OReilly Media, Inc.

Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and OReilly Media, Inc. was aware of a trademark claim, the designations have been printed in caps or initial caps.

While every precaution has been taken in the preparation of this book, the publisher and authors assume no responsibility for errors or omissions, or for damages resulting from the use of the information contained herein.

Although the chapters cover different topics, they have been arranged so that the concepts and techniques in earlier chapters form a foundation for the others.

Lays out the importance of this topic, and perhaps scares you a bit, so as to motivate you to read the book.

Describes the way Android differs from other common systems, notably desktop systems, and how its architecture both enables security and requires you to work with its unique structure.

Looks behind the familiar list of permissions that users see when adding applications to their devices, and shows how to use the system robustly without overwhelming the user.

Takes the permissions system to a finer granularity by showing how components such as Content Providers and Services can grant limited access to their data and functions.

Treats the critical topic of encrypting data so that it is secure even if the user or a thief can bypass other application security controls provided by Android (or when such controls do not apply).

Shows how you can protect the interactions between your application and the servers it communicates with.

Focuses on the key take-aways from the book.

Indicates new terms, URLs, email addresses, filenames, and file extensions.

Used for program listings, as well as within paragraphs to refer to program elements such as variable or function names, databases, data types, and environment variables.

Shows commands or other text that should be typed literally by the user.

Shows text that should be replaced with user-supplied values or by values determined by context.