How to secure my windows phone 8.1 application?

Question

I am a windows phone developer using c# and xaml technologies.
Currently I am creating a banking application for my client and it is targeting for Windows phone 8.1 OS version.

And I am using Windows Phone xaml app template for creating it.

Since It is a banking application I need to get it maximum secured. As I send my Appx file to the bank technical team , They have made concern about the app security. And they had sent me the codes I have wrote for my application by the process of reverse engineering.

What I need to do against ? And in what way we can avoid this type of vulnerabilities? Please suggest me best way to avoid this.

Thanks

Answer 1

The security of the banking application should not depend on the client code being secret. You should not store any secrets on the client as it is impossible to keep them from an attacker.

Use encrypted communications (https) to talk to the server. Validate the used certificates, authenticate the user and have the server issue an access token with a limited time to live. These are all industry best practices. Don't try to invent your own security measures.

Answer 2

I'd say Security by Obscurity isn't really state of the art any longer...

Once your package got submitted to the store, it will be encrypted and it won't be such easy to reverse engineer any longer. You can ask them to decompile a package they downloaded from the store.

Other thing you can do is using an Obfuscator by yourself to make your code harder to reverse engineer.

You have to make sure to encrypt locally stored date (for example using the PasswordVault) and such.

But in the end, you still have to deliver your code to the phone itself and if somebody really want's to work through it, he always can do that. You can just make it harder.

Update: I just checked back and the store encryption of install files only holds to be true for XAP (Silverlight) files. Don't have an official state for appx files yet, but will definitely come either.

See details here .