Mobile platforms provide security features like iOS Keychain, Android Keystore, Touch ID, and Face ID. Improper usage includes storing secrets in plaintext, disabling certificate validation, or bypassing platform security controls. Attackers exploit these gaps to extract sensitive data or intercept communications.
Apply platform security features as intended: use Keychain/Keystore for secrets, enforce biometric authentication properly, implement certificate pinning, and follow platform-specific security guidelines. Avoid bypassing built-in protections for convenience.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
Rank by release (taller is higher)
2024Latest
#01mobile01-2024 Improper Credential Usage
No change since 20162016
#01Improper Platform Usage
