Peter Kurzok pkurzok

Popular posts

1. Mobile Security Fundamentals: Build Apps That Fight Back

   Mobile Security Fundamentals: Build Apps That Fight Back

   This is the written version of the talk I gave at iOSDevUK 2026. The slides are on Speaker Deck, but you don’t need them: everything is in here, including a few slides I had to skip on stage for time. Four chapters, each one starting with the attack and ending with the defence, and all of it things you can do to an existing app this week.

   ios security swift keychain networking

2. App Attestation

   App Attestation

   App Attestation is a service of the DeviceCheck framework and, to quote the documentation, is used to ensure that the requests your server receives come from legitimate instances of your app.

   Why bother?

   Today, it is easier than ever to intercept an application’s traffic. Even on a device, without any sophisticated setup. You can download Proxyman from the App Store and read the HTTPS traffic of all apps that don’t implement any protection like certificate pinning or other measures.

3. Grandfathering

   Grandfathering

   I recently changed the business model of my app PlayTales from paying upfront to free with in-app purchase. A process also known as grandfathering.

   I got it completely wrong and it turned into a massive headache and patch release on day 1. Mainly because of what I think is terribly misleading documentation on Apple’s part.