Architecture • Android Compose
Mastering Android
App Security – 2025
Interview Edition
🔐 Security • Android Pro Interviews
🛡️ Secure Architecture • Data
Protection • Anti-Reverse
Engineering
Protect your apps with security techniques used in
banking, fintech, and enterprise apps.
1/10
Q1. What is the Android
Keystore system and why is it
important?
A:
The Android Keystore system allows apps to securely
generate and store cryptographic keys in a hardware-
backed container (Trusted Execution Environment or
StrongBox).
This ensures that private keys never leave secure hardware
— even on rooted devices — and are used only via secure
APIs.
✅ Use for: biometric auth, data encryption, secure token
signing.
2/10
Q2. How should sensitive
user data be securely stored
in Android?
A:
Use Jetpack Security libraries like
EncryptedSharedPreferences or EncryptedFile.
Encrypt data using a symmetric key stored in the Keystore.
Never store data like tokens, passwords, or user PII in plain
text or logs.
✅ Avoid SQLite for sensitive data unless encrypted.
✅ Clear in-memory data (e.g., after logout).
3/10
Q3. What is SSL Pinning
and how do you
implement it?
A:
SSL Pinning ensures the app only trusts a specific certificate or
public key, even if a rogue CA issues a valid certificate.
✅ Use OkHttp's CertificatePinner:
4/10
Q4. How can you protect
an APK from reverse
engineering?
A:
Enable R8/ProGuard for obfuscation and shrinking.
Move critical logic to native code (NDK).
Validate app signature at runtime.
Use App Integrity API to detect tampering.
Avoid storing secrets in assets or resources.
✅ Tools like JADX or apktool are used by attackers. Protect
accordingly.
5/10
Q5. What is the Play Integrity
API and how is it used?
A:
It replaces parts of SafetyNet and checks if the app:
Is installed from Google Play
Is running on a genuine, untampered device
Hasn't been modified (e.g., via patching tools)
📦 Used to block access on rooted/emulated/cloned
environments.
6/10
Q6. How do you secure API
communication in
Android?
A:
Use HTTPS (TLS 1.2+) for all endpoints
Apply SSL Pinning
Configure networkSecurityConfig to disallow cleartext
traffic
Use Authorization headers securely
Rotate access tokens, use refresh tokens
❌ Never hardcode base URLs, tokens, or secrets.
7/10
Q7. How do you detect and
prevent tapjacking
attacks?
A:
Add to sensitive UI components:
🛡️ Prevents malicious overlays from tricking users into
clicking hidden buttons.
8/10
Q8. What are best practices
for logging in production
apps?
A:
Never log sensitive data (passwords, tokens, emails)
Remove all debug logs in release builds:
Use a logging framework like Timber with a ReleaseTree
✅ Avoid leaking PII to crash logs or external analytics
unintentionally.
9/10
Q9. How do you secure
biometric authentication in
Android?
A:
Use BiometricPrompt with strong fallback and integrate
with Keystore.
✅ Encrypt sensitive data using a Keystore key protected
by biometrics:
🧠 Never use biometric to replace PIN without fallback.
10/10
Q10. What are common
Android security mistakes to
avoid?
A:
Logging sensitive data
Not using HTTPS everywhere
Weak or no obfuscation
Storing tokens or secrets in shared prefs without
encryption
Not verifying app integrity or device status
Using http:// in production
Ignoring root/emulator detection
🧨 One mistake can compromise the entire app’s
security posture.
Thank You for Reading!
Ready to dive deeper into Android, Kotlin, and
Clean Architecture?
I regularly share hands-on tutorials and
practical code tips that you can apply directly
to your projects.
Got questions or want to see specific topics
covered? Drop a comment below or send me
a DM - I'd love to hear what you're working on!