Explain how you need to protect the signing key for releasing an app

[commjoen]

Given the update in 1.1.1 of the MASVS (regarding control 7.1), we need to extend our coverage on the MSTG if it comes to securing the signing key.

Methods could include, but should not be limited to:

• using hardware keys (Yubikey/etc.)
• securing private key
• securing keychains
  See http://download.microsoft.com/download/a/f/7/af7777e5-7dcd-4800-8a0a-b18336565f5b/best_practices.doc

[cldrn]

Where would this sections be? I think we should definitely mention the new App Signing method hosted/managed by Google (https://support.google.com/googleplay/android-developer/answer/7384423?hl=en-GB).

[commjoen]

we should! 0x5a and 0x6a

[commjoen]

@cldrn : do you have any updates on this?

[cpholguera]

Hola Paulino, any news on this one? :) Thanks!

[cldrn]

Hi guys,

Wrapping up Q4 on the 19th and then I will be free to work on this one, the one for disabling keyboard cache in kotlin and updating the checklist in Spanish.

:)