...
A developer has the freedom to customize their SSL implementation, and thus has a responsibility to properly use SSL depending on the intent of the app as well as the environment the apps are used in. If the SSL is not correctly used, a user's sensitive data may leak via the vulnerable SSL communication channel.
Fahl et al [Fahl 2012] summarises describes the following patterns of the insecure use of SSL:
- Trusting All Certificates
...
- : The developer implements the TrustManager interface so that it will trust all the server certificate (regardless of who signed it, what is the CN etc.)
- Allowing All Hostnames
...
- : The app does not verify if the certificate is issued for the URL the client is connecting to.
...
- For example, when a client connects to
example.com, it will accept a server certificate issued forsome-other-domain.com. - Mixed-Mode/No SSL
...
- : A developer mixes secure and insecure connections in the same app or does not use SSL at all.
On Android, using HttpURLConnection is recommended for HTTP client implementation.
...