1. Introduction
1.1. Building a Secure Smartphone Society
This guidebook is a collection of tips concerning the know-how of secure designs and secure coding for Android application developers. Our intent is to have as many Android application developers as possible take advantage of this, and for that reason we are making it public.
In recent years, the smartphone market has witnessed a rapid expansion, and its momentum seems unstoppable. Its accelerated growth is brought on due to the diverse range of applications. An unspecified large number of key functions of mobile phones that were once not accessible due to security restrictions on conventional mobile phones have been made open to smartphone applications. Subsequently, the availability of varied applications that were once closed to conventional mobile phones is what makes smartphones more attractive.
With great power that comes from smartphone applications comes great responsibility from their developers. The default security restrictions on conventional mobile phones had made it possible to maintain a relative level of security even for applications that were developed without security awareness. As it has been aforementioned with regard to smartphones, since the key advantage of a smartphone is that they are open to application developers, if the developers design or code their applications without the knowledge of security issues then this could lead to risks of users' personal information leakage or exploitation by malware causing financial damage such as from illicit calls to premium-rate numbers.
Compared to the iPhone, Android smartphones require application developers to pay more attention to security. This is because Android smartphones have more mobile phone features open to application developers compared to the iPhone, and applications can be released on Google Play (formerly Android Market) without any screening compared to the App Store, leaving application security almost entirely in the hands of the application developers.
In conjunction with the rapid growth of the smartphone market, there has been a sudden influx of software engineers from different areas in the smartphone application development market. As a result, there is an urgent call for the sharing knowledge of secure design and consolidation of secure coding know-how for specific security issues related to mobile applications.
Due to these circumstances, Japan's Smartphone Security Association (JSSEC) has launched the Secure Coding Group, and by collecting the know-how of secure design as well as secure coding of Android applications, it has decided to make all of the information public with this guidebook. It is our intention to raise the security level of many of the Android applications that are released in the market by having many Android application developers become acquainted with the know-how of secure design and coding. As a result, we believe we will be contributing to the creation of a more reliable and safe smartphone society.
1.2. Timely Feedback on a Regular Basis Through the Beta Version
We, the JSSEC Secure Coding Group, will do our best to keep the content contained in the Guidebook as accurate as possible, but we cannot make any guarantees. We believe it is our priority to publicize and share the know-how in a timely fashion. Equally, we will upload and publicize what we consider to be the latest and most accurate correct information at that particular juncture, and will update it with more accurate information once we receive any feedback or corrections. In other words, we are taking the beta version approach on a regular basis. We think this approach would be meaningful for many of the Android application developers who are planning on using the Guidebook.
The latest version of the Guidebook and sample codes can be obtained from the URL below.
https://www.jssec.org/dl/android_securecoding_en.pdf Guidebook (English)
https://www.jssec.org/dl/android_securecoding_en.zip Sample Codes (English)
The latest Japanese version can be obtained from the URL below.
https://www.jssec.org/dl/android_securecoding.pdf Guidebook (Japanese)
https://www.jssec.org/dl/android_securecoding.zip Sample Codes (Japanese)
1.3. Usage Agreement of the Guidebook
The user must agree to the following two terms and conditions when using this Guidebook.
This Guidebook may contain inaccuracies. Please use this information at your own risk.
If you find any errors contained in this Guidebook, please contact us by e-mail using the contact information below. Please note, however, that we cannot promise to respond to you or to make any corrections.
Japan Smartphone Security Association (JSSEC)
Contact Information
1.4. About the Articles Corrected/Updated from the August 27, 2025 Edition
This section contains the revisions that were found by checking the facts against the previous version of the article. Each revised article incorporates the results of ongoing research by the authors as well as a wide range of valuable suggestions from readers. In particular, the suggestions that we received are the most important factors in making this revised edition a more practical-oriented guide with a higher degree of completeness.
Readers who have been developing apps based on the previous version are requested to take a particular look at the list of revised articles below. The items listed here do not include corrections for typographical errors, changes in organization, or simple improvements in wording.
Any comments, opinions, or suggestions on this Guidebook are greatly appreciated.
List of Corrected/Updated Articles
Section to be Corrected in the August 27, 2025 Edition |
Corrected/Updated Article in This Revised Edition |
Summary of Correction/Update |
|---|---|---|
(N/A) |
4.1.3.7. Strengthening Restrictions on Background Activity Launch (BAL) |
Added descriptions regarding the tightening of background activity launch (BAL) restrictions. |
(N/A) |
Added descriptions regarding autonomous re-pairing for Bluetooth bond loss. |
|
(N/A) |
Added descriptions regarding the tightening of Contact Provider (CP2) access. |
|
(N/A) |
Added descriptions regarding the tightening of background audio restrictions. |
|
(N/A) |
Added descriptions regarding the restriction of implicit URI permission grants. |
|
(N/A) |
Added descriptions regarding cross-profile loopback restrictions. |
|
(N/A) |
Added descriptions regarding using NFC and FeliCa. |
|
(N/A) |
Added descriptions regarding the enhancement of SMS OTP (One-Time Password) protection. |
|
(N/A) |
Added descriptions regarding enabling ECH (Encrypted Client Hello). |
|
(N/A) |
Added descriptions regarding the automatic verification of Certificate Transparency (CT). |
|
(N/A) |
5.4.3.11. Deprecation of usesCleartextTraffic and Permitting HTTP Communication |
Added descriptions regarding the deprecation of usesCleartextTraffic. |
(N/A) |
5.5.3.15. Transition to Contact Picker and Proper Handling of Contact Data |
Added descriptions regarding the migration to Contact Picker and proper handling of contact data. |
(N/A) |
Added descriptions regarding per-app keystore (key) limits. |
|
|
Reviewed the content regarding making native DCL (Dynamic Code Loading) safer. |
|
|
Added descriptions regarding the setting to hide passwords on physical devices. |
|
|
Reviewed the content regarding the handling of usesCleartextTraffic deprecation in HTTP communication. |
|
|
Reviewed the content regarding ECH and automatic verification of Certificate Transparency (CT) in HTTPS communication. |
|
|
Reviewed the content regarding the introduction of the Location Button in location access. |
|
|
Reviewed the content regarding the requirement of local network permission. |
|
|
(N/A) |
Deleted the article regarding safely launching activities from the background. |