Security Best Practices (Flutter ) - 01

As a seasoned software engineer with over seven years of experience in the field, I have had the opportunity to work on various payment apps and have encountered several issues in production. One of the most significant challenges in developing a mobile app for payment purposes is ensuring its security and reliability.

The OWASP Top 10 Mobile list highlights the most critical security risks facing mobile applications. It is important for developers to be aware of these risks and take steps to mitigate them during the development process.

Here are some essential points specific to Flutter framework to consider while building a payments related app:

Secure Data Storage

• Sensitive user data such as login credentials, personal information, and transaction history should be encrypted when stored locally or in remote databases.
• Use the flutter_secure_storage package for storing sensitive data on the device. This package provides a secure storage API for sensitive data such as passwords and OAuth2 tokens.
• Ensure that all user data is transmitted over secure connections using SSL/TLS encryption.

Hide sensitive information/Background Screen Caching/Application Vulnerable to Screen Capture and Recording

• Image cache may allow an attacker with a stolen device to profile the victim and gather sensitive information. Further, this may also lead to user privacy violations if sensitive information is displayed in clear text while the screen caching occurs.
• An attacker could capture sensitive information such as username and other details by recording the screen leading to compromise of sensitive details.
• With the secure_application package, you can add an overlay to your app to hide its content when the app is in the background.

Jailbreak and Root Detection Checks

• An attacker could gain access to the application-specific sensitive information stored on the device by jailbreaking the device.
• A jailbroken device could also allow an attacker to install additional tools to gain unauthorised access to application traffic to understand and manipulate application flow. Further, this would also allow an attacker to gain access to sensitive data stored in the device cache.
• with trust_fall package, you can detect device is Jailbroken, root, emulator and mock location detection or not.

Copy/Paste Buffer Caching

• Copy/Paste buffer caching creates serious issue when some other application has access to the clipboard which contain sensitive information.
• You can use the enableinteractiveSelection : false to Disable the copy/paste.

Code Quality and Testing

• Use a code quality tool like Dart Analyzer to detect potential security vulnerabilities in the codebase.
• Use a testing framework like Flutter Driver to perform automated end-to-end testing to ensure the app is secure and performs as expected.
• Use static analysis tools like Flutter Analyze to detect security vulnerabilities in the app's dependencies.