Yadda za ku karanta aikace-aikacen Android?

Question

Accepted Answer

Karanting aikace-aikacen Android yana haɗa da karanta **bayani** (adadi, isar da shi), shawo kan **wajen shiryawa/alamomi** da kyau, bin **ka'idar ƙaramin shahara** (izini), da kare tudu daga barcin rashin aminci. Karanti yana da mahimmanci kamar aikace-aikacen suna shawo kan bayanan dan jiya na malaƙi.

## Karanti bayani

```text
✓ ENCRYPT sensitive data at rest — EncryptedSharedPreferences, Android Keystore (for keys),
  encrypted databases (NOT plain SharedPreferences/files for secrets)
✓ Use HTTPS/TLS for all network traffic (never plaintext HTTP); certificate pinning for
  sensitive apps
✓ Don't log sensitive data; clear it appropriately; mind clipboard/screenshots
✓ Use the KEYSTORE for cryptographic keys (hardware-backed where available)
```

## Shiryawa da alamomi

```text
✓ Don't HARDCODE secrets/API keys in the app (decompilable — they can be extracted)
✓ Store tokens securely (encrypted); use secure auth (OAuth, biometrics via BiometricPrompt)
✓ Handle sessions/tokens safely; short-lived tokens; secure refresh
```

## Izini da karanti a gida

```text
✓ LEAST PRIVILEGE — request only needed permissions (less risk, more user trust)
✓ Scoped storage; validate inputs (prevent injection); secure IPC (intents, exported
  components — don't export components unnecessarily)
✓ Keep dependencies updated (vulnerabilities); use ProGuard/R8 (obfuscation, not security
  by itself but raises the bar)
✓ Validate server-side too (client can be tampered with — never trust the client alone)
```

## Me ya sa haka mahimmanci

Ja da hankali yadda za ku karanta aikace-aikacen Android yana da mahimmanci shinge-shinge sanin manyan jigon karanti, domin **aikace-aikace suna shawo kan bayanan dan jiya na malaƙi** da suna aiki a kan wu'u da za a iya lalacewa ko canja, to karanti yana da mahimmanci, tare da ainihin sakamako idan an yi watsi. **Karanti bayani** yana da gida: **shira bayani masu mahimmanci a shafu** (ta amfani da EncryptedSharedPreferences, Android Keystore don makallafi, da bayanai da aka shira maimakon ajiya a tsami — domin SharedPreferences da fayiloli ba su aminci don sirri ba, kuskure na yau da kullun), amfani da **HTTPS/TLS don duk wajan sadarwa** (ba plaintext ba, tare da maƙi-maƙi mai tsantsan wuri don aikace-aikacen da suka fi karanti), da karanta bayani daga rubutun jiki da ba'a buɓu — waɗannan suna karanta bayanan dan jiya da aikace-aikace suna shawo kan su. **Shiryawa da shawo kan alamomi** yana da mahimmanci: **ba sa buhatun sirri ko makallafi-makallafi na API a cikin aikace-aikacen** (domin za a iya buɓe aikace-aikacen da jarbaɗe sirri — ƙasira mai tsanani, kuskure na yau da kullun), adadi na jiya na zaji a tsanin aminci, da amfani da aminci na shiryawa (OAuth, ilimi-ilimi) — karanta bukatar da alamomi. **Izini da karanti gida** ya ma ba da nauyi: bin **ƙaramin shahara** (buɗe izini da ake buƙa, rage haɗari da gina aminci), amfani da ajiya da aka daidai, duba shiryawa, karanta IPC (ba a buɓe ɓatake ba da rashin buɗo), kiyaye assibitansi na ɓatage, da mahimmanci **duba gefen sabuwa** (domin za a iya lalacewa jiya da ba ya kamata a amince shi kai-kai ba — ƙaidacin karanti na gida).

Ja da hankali waɗannan ayyukan layaka suna nuna ra'ayin karanti da ake buƙa don aikace-aikacen suna shawo kan bayanan dan jiya.

Domin aikace-aikacen Android suna shawo kan bayanan dan jiya na malaƙi a kan wu'u da za a iya lalacewa, da kuma karanti da ta dace (shiran bayani, karanta sirri/ba maƙasuwa ba, ƙaramin shahara, tantance gefen sabuwa) yana karanta malaƙi da gare sakamako haƙin karanti (jarbaɗe sirri, bayani ba aminci, izmumi suka wuce kima) da kuskure na karanti ya haɓaka, jaja da hankali yadda za ku karanta aikace-aikacen Android yana mahimmanci, karanti-mahimmanci shinge-shinge sanin manyan jigon karanti — mahimmanci don karanta bayanan dan jiya da gine aikace-aikacen da za a aminci, nuna alhakin karanti da ake tsammanin shinge-shinge, da magance ainihin haɗari da suke cikin aikace-aikacen salula suna shawo kan bayanan dan jiya a wu'u da malaƙi ke mallaki.