Engineering topic / Jeffrey Monica
Mobile authentication and security boundaries
Device signals are useful inputs to a security policy, but they are not a shortcut to identity, request authorization or cryptographic verification. Start with attacker control and test the decision surface.
Key engineering considerations
Attacker control
Assume the caller can modify the client and network request. Name which checks are enforceable server-side.
Evidence binding
Bind signed evidence to a fresh challenge, intended action, and expected application context.
Recovery and revocation
Require independent step-up on dangerous paths and propagate revocation consistently.
Articles and reference guides
Android Play Integrity request binding and backend verdict policyWhat requestHash protects, what the server must verify, and why an integrity verdict is not a substitute for authorization.Authentication telemetry without leaking tokens or recovery secretsDesign privacy-conscious auth decision logs that help explain failures without recording the credentials that caused them.Device integrity is not authorization: an App Attest and Play Integrity decision modelHow to separate mobile attestation evidence from identity, request authorization, and server-side replay controls.Object-level API authorization: why a valid JWT is not enoughPractical tests for broken object-level authorization in authenticated mobile and backend APIs.Mobile session recovery as an explicit state machineModel sign-in, refresh rotation, expiry, step-up recovery, and revocation without creating a hidden authentication bypass.Hardening iOS Device Trust Signals Against Hostile ClientsA practical look at building and evaluating device trust signals under jailbreaks, instrumentation, replay, and tampered clients, with emphasis on server-side verification and failure-aware design.
Try it yourself
Device trust & replay labChange challenge age, replay state, signature verification, request binding, and assertion counters to see which server-side checks fail.Authentication state machineTrigger sign-in, expiry, refresh, revocation, and recovery. See permitted transitions and why recovery must not silently bypass step-up.API retry & idempotency labSimulate an operation that commits after a client timeout, then change retry counts and deduplication to compare server-side side effects.