Skip to main content

Key security best practices

The recommended flow for this process is:

The above process secures Veryfi credentials by preventing:​

  1. Reverse engineering attacks: Since the credentials are not being stored as part of the app source code it is not possible to get them through reverse engineering tools such as Apktool.
  2. Man in the middle attacks: Only the Public Key is sent to the API to encrypt your Veryfi credentials. This means the credentials are not accessible even if an attacker performs a Man in the Middle attack, Proxy attack, SSL attack, or similar because the credentials are encrypted and the Private Key is required to decrypt them. The Private Key is only accessible to the app that creates it.
  3. Other attacks: Since the Key Pair used for encrypting/decrypting the Veryfi credentials is created on app install and stored in Android Keystore or iOS Keychain, they’re not accessible to attackers. This is thanks to protection mechanisms supplied by the OS on the device.

API Notes:​

The API must use HTTPS with strong encryption and Veryfi credentials must be securely stored at rest on the back end.

Customer App Notes:​

  • Once the credentials are decrypted on the customer app, they may be stored securely on the device to avoid the need to fetch the Veryfi credentials after each user login. If this approach is taken, it must be done using EcryptedSharedPreferences on Android or using Keychain on iOS.

  • If feasible, consider also implementing SSL pinning in iOS applications to further mitigate man-in-the-middle attacks. Before doing so, please make sure that this is appropriate for your application as this can lead to your app becoming unusable if this isn’t implemented correctly. SSL pinning requires fallback strategies to be implemented to cater for future SSL certificate changes.