On Secret Management and Handling in Mobile Application Development Life Cycle: A Position Paper

Abstract

The security of software systems relies so heavily on the use of secrets, ranging from credentials, API keys, and tokens to secret keys for cryptographic security. This paper examines approaches for managing and handling secrets in software development life cycle, focusing on mobile applications where software must be distributed to devices and operate in an untrusted environment. This paper points out the shortcomings in activities related to secrets management and handling in mobile application development life cycle and outlines future directions in this area of research.