Engineering

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/MicrosoftTeams-image-19.webp" alt="M2P Fintech" title="" width="100%" height="358">Aadhaar data needs to be treated securely. According to the RBI and Government of India mandate, organizations that collect and store identity details must mask the first 8 digits of the Aadhaar number and reveal only the last 4 for security and compliance. Whether it's for government subsidies, income tax filing, or opening bank accounts, Aadhaar numbers must be validated and masked.&nbsp; <a class="link" href="https://m2pfintech.com/blog/edo-suite-mask-aadhaar-in-an-instant-the-right-way/">Aadhaar masking tools</a>&nbsp;use Verhoeff algorithm, a checksum algorithm to validate, detect errors and ensure the integrity of the masked Aadhaar number. At M2P, we implemented Verhoeff algorithm on <a class="link" href="https://m2pfintech.com/blog/the-implications-of-flutter-in-fintech/">Flutter.</a> Wonder how?&nbsp;&nbsp; Our engineer, <a class="link" href="https://www.linkedin.com/in/nandhakumar-k-14828813a/">Nandhakumar Krishnan,</a> delves deep into the step-by-step implementation of the Verhoeff algorithm in Flutter, which guarantees the authenticity of these crucial identification numbers. &nbsp;&nbsp; Before we embark on the journey, it's important to understand the relationship between Aadhaar numbers and Verhoeff algorithm.&nbsp;<h2 class="heading-node" id="vuzgmdwit" style="text-align: justify">Aadhaar Number and Verhoeff Algorithm</h2>Aadhaar numbers are generated by the Unique Identification Authority of India (UIDAI) and are linked to an individual's biometric and demographic information, including fingerprints, iris scans, and photographs.&nbsp;The Aadhaar number comprises 12 digits, out of which 11 digits are uniquely generated, and the last digit is the checksum.&nbsp;&nbsp; The checksum is derived from the Verhoeff algorithm using a series of mathematical calculations. The result of these calculations is used to determine the appropriate checksum digit. By appending the checksum digit to the 11-digit portion of the Aadhaar number, the Verhoeff algorithm enables easy detection of errors or discrepancies that occurs during data entry or transmission. If any of the digits are altered, the resulting Aadhaar number will fail the checksum validation.&nbsp;<h2 class="heading-node" id="ba2ymaxxe" style="text-align: justify">How to Implement the Verhoeff Algorithm?</h2>To begin implementing check digit algorithms, it is necessary to create an abstract class as a foundation for the process. This abstract class will serve as a basis for incorporating the Verhoeff algorithm and its functionality within the code.&nbsp;<h3 class="heading-node" id="ofatx47uq" style="text-align: justify">The abstract class&nbsp;&nbsp;</h3><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/MicrosoftTeams-image-15-1.webp" alt="M2P Fintech" title="" width="100%" height="329"><ul class="list-node" id="vybjsesus"><li>In order to proceed, it is important to consider the multiplication table, permutation table, and the inverse table.&nbsp;</li><li>This table is based on multiplication in the dihedral group D5 and is simply the Cayley table of the group.&nbsp;</li></ul>Note: This group is not commutative, i.e., for some values of j and k, d(j,k) != d(k, j).&nbsp;<h3 class="heading-node" id="34hzoigau" style="text-align: justify">The multiplication table&nbsp;</h3><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/MicrosoftTeams-image-16-1.webp" alt="M2P Fintech" title="" width="100%" height="329"><ul class="list-node" id="vjitqhkix"><li>In the inverse table, ‘inv’ represents the multiplicative inverse of a digit, i.e., the value that satisfies d(j, inv(j)) = 0.&nbsp;</li></ul><h3 class="heading-node" id="hou5ebcnk" style="text-align: justify">The inverse table</h3><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/MicrosoftTeams-image-17-1.webp" alt="M2P Fintech" title="" width="100%" height="91"><ul class="list-node" id="oyyt75fzn"><li>In the permutation table, p applies a permutation to each digit based on its position in the number.&nbsp;</li><li>p(pos,num)&nbsp;</li><li>This is a single permutation (1 5 8 9 4 2 7 0)(3 6) applied iteratively; i.e., p(i+j,n) = p(i, p(j,n)).&nbsp;</li></ul><h3 class="heading-node" id="avp8mfh7v" style="text-align: justify">The permutation table&nbsp;</h3><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/MicrosoftTeams-image-18-1.webp" alt="M2P Fintech" title="" width="100%" height="284">Next, we must compute the Verhoeff checksum formula.&nbsp;<h3 class="heading-node" id="tl7qvwiot" style="text-align: justify">Generating the checksum formula</h3><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/MicrosoftTeams-image-19-2.webp" alt="M2P Fintech" title="" width="100%" height="616"><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/MicrosoftTeams-image-27.webp" alt="M2P Fintech" title="" width="100%" height="556"> &nbsp; The above snippet generates a checksum for the given Aadhaar number. The validate function then verifies that the checksum matches the last digit of the Aadhaar number. If they are the same, then the Aadhaar number is considered valid.&nbsp;<h2 class="heading-node" id="kgk26r6mb" style="text-align: justify">Implementing the Verhoeff Algorithm in Flutter&nbsp;</h2>To implement the Verhoeff algorithm in your Flutter application, follow these steps:&nbsp; Step 1: Import the Verhoeff algorithm class&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/MicrosoftTeams-image-28.webp" alt="M2P Fintech" title="" width="100%" height="162">Step 2: Validate and check the digit of the user provided Aadhaar number Note: Ensure that the user inputs a number without any spaces or characters.&nbsp; The Verhoeff algorithm computes the checksum and validates the input Aadhaar number.&nbsp;&nbsp; If the computed checksum matches the last digit of the Aadhaar number, it means that the number is validated.&nbsp;<h2 class="heading-node" id="vill8wfzc" style="text-align: justify">Indispensable Layer of Security&nbsp;</h2>The Verhoeff algorithm prevents manual errors and ensures the integrity of Aadhaar numbers. This implementation adds an extra layer of protection and reliability when handling Aadhaar numbers, contributing to the overall authenticity of this vital identification system.&nbsp; The use case of the algorithm is not limited to Aadhaar numbers alone. It can be used to validate credit card numbers, phone numbers, and product codes, making it an essential tool in today's data-driven world.&nbsp; Want to know about Aadhaar validation and masking?&nbsp;&nbsp; Get in touch with us at <a class="link" href="mailto:business@m2pfintech.com">business@m2pfintech.com</a>&nbsp; <a class="link fui-Link ___1qmgydl f3rmtva f1ewtqcl fyind8e f1k6fduh f1w7gpdv fk6fouc fjoy568 figsok6 f1hu3pq6 f11qmguv f19f4twv f1tyq0we f1g0x7ka fhxju0i f1qch9an f1cnd47f fqv5qza f1vmzxwi f1o700av f13mvf36 f1cmlufx f9n3di6 f1ids18y f1tx3yz7 f1deo86v f1eh06m1 f1iescvh ftqa4ok f2hkw1w fhgqx19 f1olyrje f1p93eir f1h8hb77 f1x7u7e9 f10aw75t fsle3fq" href="https://m2pfintech.com/newsletter/" target="_blank" rel="noreferrer noopener">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox. Follow us on&nbsp;<a class="link fui-Link ___1qmgydl f3rmtva f1ewtqcl fyind8e f1k6fduh f1w7gpdv fk6fouc fjoy568 figsok6 f1hu3pq6 f11qmguv f19f4twv f1tyq0we f1g0x7ka fhxju0i f1qch9an f1cnd47f fqv5qza f1vmzxwi f1o700av f13mvf36 f1cmlufx f9n3di6 f1ids18y f1tx3yz7 f1deo86v f1eh06m1 f1iescvh ftqa4ok f2hkw1w fhgqx19 f1olyrje f1p93eir f1h8hb77 f1x7u7e9 f10aw75t fsle3fq" href="https://www.linkedin.com/company/m2pfintech/mycompany/" target="_blank" rel="noreferrer noopener">LinkedIn</a>&nbsp;and&nbsp;<a class="link fui-Link ___1qmgydl f3rmtva f1ewtqcl fyind8e f1k6fduh f1w7gpdv fk6fouc fjoy568 figsok6 f1hu3pq6 f11qmguv f19f4twv f1tyq0we f1g0x7ka fhxju0i f1qch9an f1cnd47f fqv5qza f1vmzxwi f1o700av f13mvf36 f1cmlufx f9n3di6 f1ids18y f1tx3yz7 f1deo86v f1eh06m1 f1iescvh ftqa4ok f2hkw1w fhgqx19 f1olyrje f1p93eir f1h8hb77 f1x7u7e9 f10aw75t fsle3fq" href="https://twitter.com/m2pfintech" target="_blank" rel="noreferrer noopener">Twitter</a> for insightful fintech bytes curated for curious minds like you.

Validate Aadhaar numbers using the Verhoeff Algorithm in Flutter

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/07/Banner-1.webp" alt="M2P Fintech" title="" width="100%" height="487">In the world of iOS app development, the ability to dynamically generate PDF documents from HTML content is a game changer. Imagine the possibilities of effortlessly transforming dynamic data in the form of interactive reports, professional invoices, or document generation workflows into stunning PDFs. &nbsp; In this blog, our Software Development Engineer, <a class="link" href="https://www.linkedin.com/in/balaji-pandian-905b13a4/">Balaji Pandian</a> will give you step-by-step instructions on how to generate a PDF file from HTML in an iOS app using Swift.&nbsp; To begin with, you must have Xcode installed on your machine, as it serves as the development environment for iOS apps.&nbsp;&nbsp; Let’s get started.&nbsp;<h2 class="heading-node" id="hme28mddg">Step 1: Project Set up&nbsp;</h2><ul class="list-node" id="zg7jdvkxs"><li>Open the Xcode and create a new iOS project.</li><li>Select the "Single View App" template and give your project a suitable name.</li><li>Choose Swift as the programming language and configure the desired options for other project settings.&nbsp;</li><li>&nbsp;After the project is created, navigate to the ViewController.swift file.&nbsp;</li></ul><h2 class="heading-node" id="4yc0san15">Step 2: Import Frameworks&nbsp;&nbsp;</h2>To generate PDF from HTML, we need to import the necessary frameworks. Add the following import statements at the top of ViewController.swift file:<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/07/Screenshot-2023-07-18-at-11.38.22-AM.webp" alt="M2P Fintech" title="" width="100%" height="137"><h2 class="heading-node" id="y1ph15tmb">Step 3: WebView Setup&nbsp;</h2><ul class="list-node" id="v84kzmck1"><li>Create a new class, ViewController, that inherits from UIViewController and adopts the WKNavigationDelegate protocol. This class will handle the generation of the PDF file.</li><li>Inside the ViewController class, override the viewDidLoad() method and perform the following steps:&nbsp;</li></ul><ul class="list-node" id="ztndi0sl0"><li>Create an instance of WKWebView.&nbsp;<ul class="list-node" id="2z01nr0l1"><li>Set the navigationDelegate of the web view to self.&nbsp;</li></ul></li></ul><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/07/MicrosoftTeams-image-41.webp" alt="M2P Fintech" title="" width="100%" height="140"><ul class="list-node" id="chyj4so0r"><li>Drag the Sample Invoice HTML file into the project.</li></ul><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/07/MicrosoftTeams-image-42.webp" alt="M2P Fintech" title="" width="100%" height="550">Initiate the HTML file (Invoice.html) from the bundle and load the WebView request.&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/07/Screenshot-2023-07-18-at-11.38.59-AM.webp" alt="M2P Fintech" title="" width="100%" height="142"><h2 class="heading-node" id="y5peyrzg1">Step 4: Generating PDF</h2><ul class="list-node" id="9ty9k7cs1"><li>Implement the webView(:didFinish:) method from the WKNavigationDelegate protocol. This method will be called when the web view finishes loading the JSON string to HTML file content.&nbsp;</li><li>In Swift, the evaluateJavaScript method is used to execute JavaScript code within a WKWebView or WKWebViewConfiguration object. It allows you to interact with the web content loaded in the webView and manipulate it using JavaScript.&nbsp;<ul class="list-node" id="c7580oopd"><li>Pass the webView instance to generatePDF (formatter: UIViewPrintFormatter() method.&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/07/Screenshot-2023-07-18-at-11.39.34-AM.webp" alt="M2P Fintech" title="" width="100%" height="637"></li><li>Mapping the JSON string to HTML key value&nbsp;&nbsp;</li></ul></li></ul><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/07/MicrosoftTeams-image-39-1.webp" alt="M2P Fintech" title="" width="100%" height="930"><ul class="list-node" id="p5u3a95y2"><li>Implement the generatePDF method that takes a WKWebView instance and a handler.&nbsp;<ul class="list-node" id="a4ggsobqv"><li>Create an instance of UIPrintPageRenderer&nbsp;</li><li>Add the web view's viewPrintFormatter() to the print page renderer&nbsp;</li><li>Set the paper size and printable area of the PDF&nbsp;</li><li>Create an instance of NSMutableData to store the PDF data&nbsp;</li><li>Initiate the PDF context using UIGraphicsBeginPDFContextToData().&nbsp;</li><li>Iterate over the print page renderer's number of pages and draw each page using UIGraphicsBeginPDFPage() and printPageRenderer.drawPage(at:in:).&nbsp;</li><li>End the PDF context using UIGraphicsEndPDFContext().&nbsp;</li><li>Pass the generated PDF data.&nbsp;</li></ul></li></ul><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/07/Screenshot-2023-07-18-at-11.37.56-AM.webp" alt="M2P Fintech" title="" width="100%" height="677"><ul class="list-node" id="lo9g3z837"><li>Implement the savePDFToDisk(pdfData:) method to save the generated PDF data to the device's document directory.&nbsp;<ul class="list-node" id="525ws2f7l"><li>Check if the PDF data is not NIL&nbsp;</li><li>Get the document directory path using NSSearchPathForDirectoriesInDomains().&nbsp;</li><li>Construct the file path for the PDF&nbsp;&nbsp;</li><li>Use pdfData.write(to:) to save the PDF data to the file&nbsp;</li><li>Handle if any errors occur during the file-saving process&nbsp;</li></ul></li></ul><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/07/Screenshot-2023-07-18-at-11.40.10-AM.webp" alt="M2P Fintech" title="" width="100%" height="504">To achieve a PDF preview with full view in Swift UI, you can utilize the PDFView class provided by Apple's PDFKit framework.&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/07/MicrosoftTeams-image-38.webp" alt="M2P Fintech" title="" width="100%" height="296">The below figure shows the final output of the conversion of PDF file from HTML format<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/07/invoice-1.webp" alt="M2P Fintech" title="" width="100%" height="487">By leveraging the WebKit framework, we have successfully achieved the rendering of HTML content within a WKWebView, subsequently converting it into a PDF document.&nbsp; It is important to note that handling error cases and tailoring the code to meet your specific requirements is essential.&nbsp;&nbsp; There are further possibilities to explore and enhance the PDF generation process by:&nbsp;<ul class="list-node" id="5vxn85mom"><li>Empowering users to dynamically customize the HTML content&nbsp;</li><li>Elevating the PDF layout with print page renderer modifications&nbsp;&nbsp;</li><li>Implementing pagination and header/footer support&nbsp;</li></ul>You can also explore and combine various techniques to create unique and compelling PDFs tailored to your specific requirements on the fly. So, dive in, experiment, and explore.&nbsp; Happy coding!&nbsp; Want to know more, reach out to us at <a class="link" href="mailto:business@m2pfintech.com">business@m2pfintech.com.</a>&nbsp;&nbsp; Our team of experts is eager to connect with you.&nbsp; <a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox. Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a> for insightful fintech bytes curated for curious minds like you.

How to Generate PDFs from HTML in iOS using Swift UIKit

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/CI-CD-Banner-1.webp" alt="M2P Fintech" title="" width="100%" height="253">Fixing a critical bug in your code can save the integrity of your project.&nbsp;&nbsp;What is equally important is continuously improving the quality of the code, testing, and automating it for new release. Developers must make sure they follow all these processes while seamlessly communicating the changes with their team members.&nbsp;&nbsp;That’s why development teams across the world practice a mechanism called Continuous Integration (CI) and Continuous Delivery (CD).&nbsp;Starting from generating a build using command line, uploading build to test flight using fast lane, interfacing Jenkins with bitbucket and Fastlane, CICD mechanism can simplify and automate the process of build generation for iOS developers.&nbsp;We are coming up with a 3-part series covering the A-Z of deploying CI/CD mechanism for automating build generation.&nbsp;&nbsp;In this blog, we will be talking about generating a local build using command line.&nbsp;Let’s dive in.&nbsp;This blog is written by <a class="link" href="https://www.linkedin.com/in/ranjith-ravichandran-73829793/">Ranjith Ravichandran</a>, Senior SDE, Product Engineering at M2P.&nbsp;<h2 class="heading-node" id="vixdomkir" style="text-align: justify">What is CI/CD?&nbsp;</h2>Continuous Integration is the practice of merging code changes to a shared repository many times a day. It includes automated building generation and testing. &nbsp;Continuous Delivery is continuous integration with additional processes which allows application release to the customers after each change or update. &nbsp;&nbsp;<h2 class="heading-node" id="gf7yuvxyf" style="text-align: justify">Why CI/CD?&nbsp;</h2>Continuous integration and continuous delivery (CI/CD) is a critical component of agile software development, which emphasizes the importance of delivering working software to users quickly and frequently. This allows stakeholders and users to access newly created features and provide feedback as soon as possible, so features can be iteratively improved.&nbsp;CI/CD is a valuable tool for software developers, regardless of the size of their team. For solo developers, CD may be even more important, as it can help to ensure that software is delivered to users quickly and reliably.&nbsp;In this blog, we will show you the behind the scenes of building, testing, archiving, and uploading an iOS application. Being aware of the native Apple developer tools and learning command line interaction is integral for anyone using CI/CD mechanism.&nbsp;Command line interactions can help you with the following.&nbsp;<ul class="list-node" id="pte7t3cwf"><li>Understanding apple technologies used for building and deploying an iOS application&nbsp;</li><li>Automating iOS development task for continuous integration or cloud-based servers&nbsp;</li><li>Understanding the background working of tools like <a class="link" href="https://fastlane.tools/">Fastlane</a>&nbsp;</li></ul><h2 class="heading-node" id="k829yqqxm" style="text-align: justify">Automating Build Generation – Overall Process</h2><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/CI-CD-img1.webp" alt="M2P Fintech" title="" width="100%" height="253"><ul class="list-node" id="2rh1i4is1"><li>Setting up the project and creating a repository in Bit Bucket&nbsp;</li><li>Connecting local Jenkins with Bit Bucket cloud to check out as project branch (to build as an IPA)&nbsp;</li><li>Connecting Jenkins and Fastlane for building and archiving the project</li><li>Moving the archived IPA to TestFlight from Fastlane</li></ul><h2 class="heading-node" id="718gbf2sl" style="text-align: justify">Build Generation using Command Line</h2><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/CI-CD-img2.webp" alt="M2P Fintech" title="" width="100%" height="261">Let’s assume that a project is developed by multiple engineers where they all must perform the following.&nbsp;<ul class="list-node" id="8xgwyb9oq"><li>Checking out the project from Bit Bucket to local system&nbsp;</li><li>Archiving the particular branch of the project using command line&nbsp;</li></ul>After following the above processes, the IPA is generated inside the project folder.&nbsp; To understand the command line deployment process, we should have the following things set up in advance before starting the build generation. &nbsp;<h2 class="heading-node" id="wl1vjw4rj" style="text-align: justify">Pre-requisites</h2><ul class="list-node" id="zxps2bfin"><li>Sample app with Xcode workspace - e.g., FintechBase.xcworkspace &nbsp;</li><li>Xcode Scheme with Release configuration - e.g., Developement &nbsp;</li></ul><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/MicrosoftTeams-image-3.webp" alt="M2P Fintech" title="" width="100%" height="270"><ul class="list-node" id="yyqu3ol0l"><li>Certificates, AppID, Provisioning profiles setup for production in iTunes Connect - Use <a class="link" href="https://help.apple.com/xcode/mac/current/#/dev60b6fbbc7">Apple’s documentation</a> for setting up&nbsp;</li><li>macOS with Distribution certificate in the keychain &nbsp;</li></ul><h3 class="heading-node" id="8sncc4746" style="text-align: justify">Analyzing &nbsp;</h3>We perform static analysis of the source code. The xcodebuild has the ability to clean and analyze the source code for any common syntax errors. &nbsp;<h3 class="heading-node" id="ceoujw6ub" style="text-align: justify">Code for analyzing the project using the terminal&nbsp;&nbsp;</h3>xcodebuild - workspace FintechBase.xcworkspace -scheme Development -sdkiphonesimulator10.3 clean analyze &nbsp;<h3 class="heading-node" id="kfx4bsyjr" style="text-align: justify">Building &nbsp; &nbsp;</h3>We can build an iOS app using xcodebuild ‘build’ action which can generate the derived data for our iOS app. Once the application is built, it can run inside the simulator or can be used by the test bundle. &nbsp;<h3 class="heading-node" id="2l3qqcg9r" style="text-align: justify">Build for running &nbsp;</h3>We can simply build our app to run inside simulators by using the command &nbsp;xcodebuild -workspace FintechBase.xcworkspace -scheme Development -configuration Release -allowProvisioningUpdates build &nbsp;<h3 class="heading-node" id="qpt6jm8bp" style="text-align: justify"> Archiving </h3>Most of the iOS engineers face difficulties in archiving an iOS application as it deals with provisioning profiles, certificates, and build configurations.&nbsp;To upload an app to iTunes Connect or deploy it on to the provisioned devices, we need to build an app for generic iOS device destination as well as export it in the IPA format. &nbsp;Next step is building our application with release configuration scheme ‘Development’ with generic iOS device destination. &nbsp; &nbsp;There are two steps involved.&nbsp;<ul class="list-node" id="lt01qgpu1"><li>Building an archive with xcodebuild archive &nbsp;</li><li>Creating the .ipa file with xcodebuild -exportArchive &nbsp;</li></ul><h4 class="heading-node" id="uimw8zxqa" style="text-align: justify">Without Team ID &nbsp;</h4>xcodebuild archive -workspace FintechBase.xcworkspace -scheme Development clean build archive  -archivePath ./build/FintechBase.xcarchive &nbsp;<h4 class="heading-node" id="lw00yqpeu" style="text-align: justify">With Team ID &nbsp;</h4>xcodebuild archive -workspace FintechBase.xcworkspace -scheme Development DEVELOPMENT_TEAM="XXXXXXXXXX" -allowProvisioningUpdates  -archivePath ./build/FintechBase.xcarchive &nbsp;<h4 class="heading-node" id="b1r52lons" style="text-align: justify">Note&nbsp;</h4><ul class="list-node" id="r267dseji"><li>The build is created using the above command build/FintechBase.xcarchive&nbsp;</li><li>Replace ‘XXXXXXXXX’ with your team ID&nbsp;</li></ul>We now export the .ipa using the command&nbsp;xcodebuild -exportArchive -allowProvisioningUpdates -archivePath  ./build/FintechBase.xcarchive -exportPath ./build/ -exportOptionsPlist ./build/ExportOptions.plist &nbsp;Note that the above command requires a ExportOptions argument that points to a .plist file with export options. For a complete list of what you can put in that plist, run xcodebuild -help.&nbsp;&nbsp;Create build folder in a project and add ExportOptions.plist<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/MicrosoftTeams-image-1-1.webp" alt="M2P Fintech" title="" width="100%" height="530"><h4 class="heading-node" id="q4fzt0obs" style="text-align: justify">Find the sample code for ExportOptions</h4><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/MicrosoftTeams-image-2-1.webp" alt="M2P Fintech" title="" width="100%" height="199">&lt;?xml version="1.0" encoding="UTF-8"?&gt; &nbsp;&lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN""<a class="link" href="http://www.apple.com/DTDs/PropertyList-1.0.dtd">http://www.apple.com/DTDs/PropertyList-1.0.dtd</a>"&gt; &nbsp;&lt;plist version="1.0"&gt; &nbsp;&lt;dict&gt; &nbsp;&lt;key&gt;generateAppStoreInformation&lt;/key&gt; &nbsp;&lt;false/&gt; &nbsp;&lt;key&gt;manageAppVersionAndBuildNumber&lt;/key&gt; &nbsp;&lt;true/&gt; &nbsp;&lt;key&gt;method&lt;/key&gt; &nbsp;&lt;string&gt;app-store&lt;/string&gt; &nbsp;&lt;key&gt;signingStyle&lt;/key&gt; &nbsp;&lt;string&gt;automatic&lt;/string&gt; &nbsp;&lt;key&gt;stripSwiftSymbols&lt;/key&gt; &nbsp;&lt;true/&gt; &nbsp;&lt;key&gt;teamID&lt;/key&gt; &nbsp;&lt;string&gt;XXXXXXXXXX&lt;/string&gt; &nbsp;&lt;key&gt;uploadSymbols&lt;/key&gt; &nbsp;&lt;true/&gt; &nbsp;&lt;/dict&gt; &nbsp;&lt;/plist&gt; &nbsp; &nbsp;<h4 class="heading-node" id="ga13psli6" style="text-align: justify">Export Options</h4><ul class="list-node" id="kmyta6keu"><li>method: (String) The method of distribution, which can be set as any of the following: <ul class="list-node" id="vjjzjfgiv"><li>app-store &nbsp;</li><li>enterprise &nbsp;</li><li>ad-hoc </li><li>development &nbsp;</li></ul></li></ul><ul class="list-node" id="6jmqzfr7a"><li>teamID: (String) The development program team identifier. </li><li>signingtyle: (String) Automatic Signing “automatic”, incase of manual signing mention “manual” add provisioningProfiles and signingCertificate </li><li>uploadBitcode: (Boolean) Option to include Bitcode. </li><li>manageAppVersionAndBuildNumber: to ensure that you have already updated your version/build number before archiving</li><li>generateAppStoreInformation: For App Store exports, should Xcode generate App Store Information for uploading with iTMSTransporter. Defaults to NO </li><li>uploadSymbols: Should symbols be stripped from Swift libraries in your IPA. Defaults to YES</li></ul> &nbsp;After successfully running the command, the ipa file will be generated inside the build folder in the name of FintechBase.ipa&nbsp;The next step involves automating the build generation using Fastlane and pushing it to TestFlight which we will be covering in the next blog.&nbsp;Till then, Stay tuned!&nbsp;Have any questions/suggestions?&nbsp;&nbsp;&nbsp;Write to us at <a class="link" href="mailto:business@m2pfintech.com">business@m2pfintech.com</a>. Our expert team will get in touch with you.&nbsp;&nbsp;&nbsp;<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a> to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.&nbsp;Follow us on <a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a> and <a class="link" href="https://twitter.com/m2pfintech">Twitter</a> for insightful fintech bytes curated for curious minds like you.&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;

CI/CD Pipeline for iOS build generation using Jenkins

&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2024/03/Creative-for-SSL.webp" alt="M2P Fintech" title="" width="100%" height="253">Welcome to our latest blog, where we dive into the critical security technique known as SSL Pinning. This method plays a pivotal role in thwarting eavesdropping attacks on the communication between an app and its server.SSL Pinning involves a process where, after the initial exchange of encryption keys, the app verifies the validity of the server's certificate. It achieves this by maintaining a list of trusted certificates on the device itself, which are then compared to the server's certificate in real time as the app operates.&nbsp;If there is a discrepancy, indicating that the server's certificate does not align with the trusted ones, the app promptly halts the connection.&nbsp;Types of SSL Pinning:<ul class="list-node" id="c5h0hkum0"><li>SSL Pinning using Certificate: This method has the drawback that we must update the app each time the pinned certificate expires. However, by anchoring upcoming certificates in the application, this problem may be resolved. We may use the hashed public key, which won't change for subsequent certifications, rather than pinning the entire certificate.&nbsp;</li></ul><ul class="list-node" id="8d24u2471"><li>SSL Pinning using server Public key:&nbsp;This method includes attaching the certificate's public key (certificate expiration need not be a concern here).</li></ul>Mobile applications must retrieve data from the server to display it to consumers. However, private data, such as the user's login and password, is occasionally transmitted between the program and the server. SSL Pinning is mainly used in the prevention of man-in-the-middle attacks.Man-In-The-Middle Attack &nbsp;This type of attack allows the attacker to covertly view data passed from the client to the server by using a specialized server called an SSL proxy. It is a tool that encrypts and decrypts data between the client and the server using different keys for each direction. Charles, a proxy server used for testing, is one such example. It works in several phases to intercept and analyze the data between the app and the server.  By sitting between the app and the internet, it allows you to examine and modify data in real-time to test the response of the application.&nbsp;<ol class="list-node" id="xyrs1alxr"><li>Instead of using the server's key to encrypt data, your app utilizes the public key of the Charles ProxyCertificate. The Charles Certificate is considered valid because the developer can install it on their device.&nbsp;</li><li><a class="link" href="https://www.kodeco.com/21931256-charles-proxy-tutorial-for-ios">Charles</a> may connect to the server using its public key after using its private key to decode all the data. Be aware that any developer can read all the data that your app sends over the network. &nbsp;</li></ol>SSL Pinning using Public Key &nbsp;<ul class="list-node" id="r0h4qy5p1"><li>Get public certificates using OpenSSL by typing a command in the terminal/console to get the PEM key. &nbsp;</li></ul>echo "Get HTTP/1.0" | openssl s_client -showcerts -connectwww.MyDomainName.com:443 &gt; myPemCertificateName.pem &nbsp;<ul class="list-node" id="93uejjeug"><li>Type this command to turn the created PEM key into .der format.</li></ul>openssl x509 -in "myPemFileName.pem" -inform PEM -out "myDerFileName.der" -outform DER &nbsp;<ul class="list-node" id="62sgzhr0g"><li>Use this command to get the public key from the URL in SHA256 format. &nbsp;</li></ul>openssl s_client -connect www.MyDomainName.com:443 | openssl x509 -pubkey -noout | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64 &nbsp;<ul class="list-node" id="bos2d0jr8"><li>443 is the safe port for HTTPS. If your website uses a different port, use that number instead of 443. &nbsp;</li><li>The result should look like this. &nbsp;</li></ul>A3r26k+KOMuKJHB5B67cpGqqPhF/GNUyNl2EPJKB65KJUe+hXMn1k= &nbsp;<ul class="list-node" id="munqf5sov"><li>Generate the Hash Key using this <a class="link" href="https://www.ssllabs.com/ssltest/">link</a> as well. &nbsp;</li></ul><ul class="list-node" id="a5wc1jmum"><li>Create a variable to store the Public key that we get from the certificate. &nbsp;</li></ul>static let sslPublicKey ="A3r26k+KOMuKJHB5B67cpGqqPhF/GNUyN2EPJKB6KJUe+hXMn1k=" &nbsp;Pinning with Alamofire &nbsp;<ul class="list-node" id="vlgnafls0"><li>Using the regular API can be complicated. Using Alamofire is recommended because it is an external library that offers a simpler way to work with APIs, making your life easier. &nbsp;</li><li>The ServerTrustEvaluating protocol is the foundation of everything. It allows us to evaluate server trust in various ways. Alamofire has several trust evaluators. You can read the full documentation <a class="link" href="https://github.com/Alamofire/Alamofire/blob/master/Documentation/AdvancedUsage.md#security">here</a>. &nbsp;</li><li>Select the ServerTrustEvaluator for each API. &nbsp;</li></ul> <img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2024/03/ss1.webp" alt="M2P Fintech" title="" width="100%" height="138"><ul class="list-node" id="7fgyhm915"><li>Then create a session with them, and you can customize your configuration. &nbsp;</li></ul> <img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2024/03/ss2.webp" alt="M2P Fintech" title="" width="100%" height="88"><ul class="list-node" id="p64ip70za"><li>rsa2048Asn1Header is a list of whole numbers that shows the algorithm and any additional information used with the public key. &nbsp;</li><li>This private func sha256(data: Data) -&gt; String function creates a coded hash using the sha256 method for the given data and encodes it in base64. &nbsp;</li><li>import CommonCrypto for sha256 algorithm &nbsp;</li><li>In SessionDelegate, the URLAuthenticationChallenge method is used to get ServerPublicKeyData &nbsp;</li></ul> <img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2024/03/ss3.webp" alt="M2P Fintech" title="" width="100%" height="44"><ul class="list-node" id="0b7oumb7i"><li>We can perform some actions using this delegate method and match our Public Key with Server Public Key. &nbsp;</li></ul> <img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2024/03/ss4.webp" alt="M2P Fintech" title="" width="100%" height="569">Implementing SSL pinning using a public key in iOS enhances security by ensuring that only trusted servers with specific public keys can establish connections. This method mitigates the risks associated with man-in-the-middle attacks and unauthorized access to sensitive data, providing users with a more secure experience.Stay tuned for more blogs on tech, engineering, and iOS development.&nbsp;This blog is written by <a class="link" href="https://teams.microsoft.com/l/message/19:2ef83816-29e0-4b52-8caa-64b0aeca1ec1_dd9ec8f1-8445-4b0a-92af-aa769014f3db@unq.gbl.spaces/1709882415989?context=%7B%22contextType%22%3A%22chat%22%7D">Senthilkumar</a>, SDE 2 – Product Engineering at M2P.

Setting up SSL Pinning using Public Key in Swift

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/04/Penetration-testing-banner1.webp" alt="M2P Fintech" title="" width="100%" height="253">The $158.9 billion fintech industry thrives on mobile apps. Android dominates the mobile app market with a whopping 71.65% market share. Though in demand globally, its open-source&nbsp;nature makes data security a vulnerability in Android apps. Even <a class="link" href="https://m2pfintech.com/blog/super-apps-in-consumer-banking-what-role-does-open-banking-play/">super apps</a> are no exception.&nbsp;Developing and releasing a fully functional and secure Android application is a critical challenge for app developers. Managing app functionality is the easy part; but the real challenge is making the Android application secure and resilient to cyberattacks. &nbsp;What’s the best way to do this?&nbsp;Our Software Development Engineer, <a class="link" href="https://www.linkedin.com/in/sundaramanikandan-l-80957014b/">Sundaramanikandan</a> has hands-on experience in developing highly secure Android apps and will take us through every step in mitigating cyberattacks while developing an app. &nbsp;First things first, every developer must prioritize security to protect users and their data. The security-first approach will benefit the 6.92 billion smartphone users in the world, who constitute over 86.29% of the global population.&nbsp;&nbsp;Remember that the advances in digitization and technology also apply to hackers and cybercriminals. Technology that makes lives easier has increased our exposure to risks. Fraudsters ride on the vulnerabilities by using more sophisticated techniques to exploit loopholes and evade detection while breaking into systems to access sensitive data.&nbsp;<h2 class="heading-node" id="sdulm87wi" style="text-align: justify">How to secure Android devices from attackers?&nbsp;</h2>Developers and organizations need to deploy secure software development lifecycle practices to protect against data breaches or theft. Public Wi-Fi networks and other wireless communication systems should be blocked to prevent man-in-the-middle attacks and other unsecured communication exploits. Attackers can pretend to be real web services, steal data, or listen in on calls and texts by taking over a user's mobile signal.&nbsp;<h2 class="heading-node" id="d5lk42h71" style="text-align: justify">Smartphone rooting to get superuser permissions&nbsp;&nbsp;&nbsp;</h2>Firstly, the process called rooting is done, i.e., removing the limitations on a mobile or tablet running the Android operating system. It lets you get root access to the code of the Android operating system (the equivalent term for Apple devices is jailbreaking). It gives permission to change the device's software code or install software that the manufacturer wouldn't normally let us do.&nbsp;<h2 class="heading-node" id="oj87o5xpb" style="text-align: justify">Cons of running apps on a rooted device&nbsp;</h2>Simply put, it opens higher risks like spoofing, cheating, and abuse of core functionalities. A root-level app can easily set up backdoors that let unauthorized users get into the device and then into the secure corporate network. When you "root" your Android device, you give apps unauthorized access to your operating system and sensitive data. It further leads to the theft of user data, finances, intellectual property, and piracy. Some malware apps specifically go after rooted devices to infect system-level files. So, you must be careful what you install.&nbsp;Targeted cyberattacks on corporates are on the rise as more and more business transactions are done on mobile devices. Rooted Android devices make it easier to sneak into the corporate network. For a financial app, if an attacker can intercept a network call and change the address, the victim could lose a lot of money, and the company that developed the app will lose its reputation.&nbsp;As having a user-friendly mobile app is a key differentiator, banks and financial institutions are in a dilemma to choose between allowing their app, which contains excellent payment functionalities and extremely sensitive data, to run on rooted/jailbroken devices or risk losing their target audience. Or they can opt for the middle ground by mitigating the risks of the app running on rooted devices. This compromise is critical. Or else, risks such as malware, man-in-the-middle attacks, and system API hijacking could lead to user data exfiltration. &nbsp;Therefore, Android app installation must be blocked on rooted devices to prevent attacks specifically targeting users who have rooted their smartphones.&nbsp;<h2 class="heading-node" id="78wzaxox3" style="text-align: justify">How can app developers block Android installation on a rooted device?&nbsp;</h2>Every Android app developer should understand the following pointers below to steer clear of the hazards of rooted devices.&nbsp; What’s the common way an app can be tampered with?&nbsp;<ol class="list-node" id="lwmuzqjzn"><li>ByPassing root detection logic implemented&nbsp;&nbsp;</li><li>ByPassing the SSL Pinning&nbsp;</li></ol>What are the commonly used hacking tools?&nbsp;<ol class="list-node" id="tym0kml1c"><li>Magisk&nbsp;</li><li>LSXposed Framework&nbsp;</li></ol>Dos and Don’ts - for infosec clearance to block Android app installation&nbsp;Don’ts&nbsp;❌ Install the app on a rooted device&nbsp;❌ Tapjack&nbsp;❌ Copy/paste sensitive data&nbsp;❌ Take screenshots&nbsp;&nbsp;Dos&nbsp;Now, the following method will help create the most comprehensive approach:&nbsp;✅ Check if the app is running in emulator&nbsp;This is the first thing we need to look at when the app is launched. If a hacker extracts the APK and tries to run it in an emulator/simulator, we should stop running the app if it is a production version. This functionality can be built as an extension function and utilized in the application's base activity.&nbsp;<pre class="block-node"><code>val isRunningOnEmulator: Boolean by lazy {
&nbsp;&nbsp;&nbsp; // Android SDK emulator
&nbsp;&nbsp;&nbsp; return@lazy ((Build.FINGERPRINT.startsWith(“google/sdk_gphone_”)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &amp;&amp; Build.FINGERPRINT.endsWith(“:user/release-keys”)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &amp;&amp; Build.MANUFACTURER == “Google” &amp;&amp; 
Build.PRODUCT.startsWith(“sdk_gphone_”) &amp;&amp; Build.BRAND == “google”
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &amp;&amp; Build.MODEL.startsWith(“sdk_gphone_”))
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || Build.HARDWARE.contains(“goldfish”)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || Build.HARDWARE.contains(“ranchu”)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || Build.PRODUCT.contains(“sdk_gphone64_arm64”)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || Build.PRODUCT.contains(“vbox86p”)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || Build.PRODUCT.contains(“emulator”)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || Build.PRODUCT.contains(“simulator”)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || Build.FINGERPRINT.startsWith(“generic”)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || Build.FINGERPRINT.startsWith(“unknown”)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || Build.PRODUCT.contains(“sdk_google”)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || Build.MODEL.contains(“google_sdk”)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || Build.PRODUCT.contains(“sdk_x86”)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || Build.MODEL.contains(“Emulator”)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || Build.MODEL.contains(“Android SDK built for x86”)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || “QC_Reference_Phone” == Build.BOARD &amp;&amp; !“Xiaomi”.equals(
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Build.MANUFACTURER,
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ignoreCase = true
&nbsp;&nbsp;&nbsp; )
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || Build.MANUFACTURER.contains(“Genymotion”)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || Build.HOST.startsWith(“Build”) //MSI App Player
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || Build.BRAND.startsWith(“generic”) &amp;&amp; Build.DEVICE.startsWith(“generic”)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; || Build.PRODUCT == “google_sdk”)
}&nbsp;

✅ Check developer options&nbsp;

Hooking an app is as simple as enabling the developer settings on the device and connecting to the Android SDK tool. Hence, when the app is launched, we must determine whether the developer option is enabled or not by writing an extension function.&nbsp;

fun isDevMode(context: Context): Boolean {&nbsp;
&nbsp;&nbsp;&nbsp; return when {&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Build.VERSION.SDK_INT &gt; Build.VERSION_CODES.JELLY_BEAN -&gt; {&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Settings.Secure.getInt(&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; context.contentResolver,&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Settings.Global.DEVELOPMENT_SETTINGS_ENABLED, 0&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ) != 0&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Build.VERSION.SDK_INT == Build.VERSION_CODES.JELLY_BEAN -&gt; {&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; @Suppress(“DEPRECATION”)&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Settings.Secure.getInt(&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; context.contentResolver,&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Settings.Secure.DEVELOPMENT_SETTINGS_ENABLED, 0&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ) != 0&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; else -&gt; false&nbsp;
&nbsp;&nbsp;&nbsp; }&nbsp;
}&nbsp;

✅ Check if the device is rooted&nbsp;&nbsp;

The Util class is commonly used to determine whether a device is rooted, or the super user “SU” is enabled.&nbsp;

private val binaryPaths = arrayOf(
&nbsp;&nbsp;&nbsp; “/data/local/”,
&nbsp;&nbsp;&nbsp; “/data/local/bin/”,
&nbsp;&nbsp;&nbsp; “/data/local/tmp/”,
&nbsp;&nbsp;&nbsp; “/data/local/xbin/”,
&nbsp;&nbsp;&nbsp; “/sbin/”,
&nbsp;&nbsp;&nbsp; “/su/bin/”,
&nbsp;&nbsp;&nbsp; “/system/bin/”,
&nbsp;&nbsp;&nbsp; “/system/bin/.ext/”,
&nbsp;&nbsp;&nbsp; “/system/bin/failsafe/”,
&nbsp;&nbsp;&nbsp; “/system/sd/xbin/”,
&nbsp;&nbsp;&nbsp; “/system/usr/we-need-root/”,
&nbsp;&nbsp;&nbsp; “/system/xbin/”,
&nbsp;&nbsp;&nbsp; “/system/app/Superuser.apk”,
&nbsp;&nbsp;&nbsp; “/cache”,
&nbsp;&nbsp;&nbsp; “/data”,
&nbsp;&nbsp;&nbsp; “/dev”,

&nbsp;&nbsp;&nbsp; “/sbin/su”,
&nbsp;&nbsp;&nbsp; “/system/bin/su”,
&nbsp;&nbsp;&nbsp; “/system/xbin/su”,
&nbsp;&nbsp;&nbsp; “/data/local/xbin/su”,
&nbsp;&nbsp;&nbsp; “/data/local/bin/su”,
&nbsp;&nbsp;&nbsp; “/system/sd/xbin/su”,
&nbsp;&nbsp;&nbsp; “/system/bin/failsafe/su”,
&nbsp;&nbsp;&nbsp; “/data/local/su”,
&nbsp;&nbsp;&nbsp; “/su/bin/su”,
&nbsp;&nbsp;&nbsp; “./frida-server”,
&nbsp;&nbsp;&nbsp; “/data/local/tmp/frida-server”

)&nbsp;

&nbsp;When this class is called upon app launch, it checks to see whether any of the aforementioned binaries are present on the device and returns “rooted” if any are.&nbsp;

✅ Integrate root detection library like RootBear&nbsp;

RootBear is a popular open-source library that can be utilized in our app to detect root causes.&nbsp;

implementation ‘com.scottyab:rootbeer-lib:0.1.0′&nbsp;

After adding this library in the app build Gradle file, it can be implemented in a base activity like:&nbsp;

if (!BuildConfig.DEBUG &amp;&amp; rootBeer.isRooted) {
&nbsp;&nbsp;&nbsp; showRootedDeviceDialog(getString(R.string.device_rooted))
&nbsp;&nbsp;&nbsp; isRootedDeviceBool = true
} else if (!BuildConfig.DEBUG &amp;&amp; rootBeer.isRootedWithBusyBoxCheck) {
&nbsp;&nbsp;&nbsp; showRootedDeviceDialog(getString(R.string.device_rooted))
&nbsp;&nbsp;&nbsp; isRootedDeviceBool = true
}&nbsp;&nbsp; 
</code></pre>Now, all the steps discussed around a great way to prevent an Android app from being installed or functioning on a rooted device. &nbsp;But this is not all. There is more.&nbsp;There is another tool called ‘Frida’ that helps bypass all the above logics implemented in an app.&nbsp;Want to know how to block Frida?&nbsp;Stay tuned to our next blog!&nbsp;This article is authored by&nbsp;<a class="link" href="https://www.linkedin.com/in/sundaramanikandan-l-80957014b/">Sundaramanikandan.</a><a class="link fui-Link ___1qmgydl f3rmtva f1ewtqcl fyind8e f1k6fduh f1w7gpdv fk6fouc fjoy568 figsok6 f1hu3pq6 f11qmguv f19f4twv f1tyq0we f1g0x7ka fhxju0i f1qch9an f1cnd47f fqv5qza f1vmzxwi f1o700av f13mvf36 f1cmlufx f9n3di6 f1ids18y f1tx3yz7 f1deo86v f1eh06m1 f1iescvh ftqa4ok f2hkw1w fhgqx19 f1olyrje f1p93eir f1h8hb77 f1x7u7e9 f10aw75t fsle3fq" href="https://m2pfintech.com/newsletter/" target="_blank" rel="noreferrer noopener">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link fui-Link ___1qmgydl f3rmtva f1ewtqcl fyind8e f1k6fduh f1w7gpdv fk6fouc fjoy568 figsok6 f1hu3pq6 f11qmguv f19f4twv f1tyq0we f1g0x7ka fhxju0i f1qch9an f1cnd47f fqv5qza f1vmzxwi f1o700av f13mvf36 f1cmlufx f9n3di6 f1ids18y f1tx3yz7 f1deo86v f1eh06m1 f1iescvh ftqa4ok f2hkw1w fhgqx19 f1olyrje f1p93eir f1h8hb77 f1x7u7e9 f10aw75t fsle3fq" href="https://www.linkedin.com/company/m2pfintech/mycompany/" target="_blank" rel="noreferrer noopener">LinkedIn</a>&nbsp;and&nbsp;<a class="link fui-Link ___1qmgydl f3rmtva f1ewtqcl fyind8e f1k6fduh f1w7gpdv fk6fouc fjoy568 figsok6 f1hu3pq6 f11qmguv f19f4twv f1tyq0we f1g0x7ka fhxju0i f1qch9an f1cnd47f fqv5qza f1vmzxwi f1o700av f13mvf36 f1cmlufx f9n3di6 f1ids18y f1tx3yz7 f1deo86v f1eh06m1 f1iescvh ftqa4ok f2hkw1w fhgqx19 f1olyrje f1p93eir f1h8hb77 f1x7u7e9 f10aw75t fsle3fq" href="https://twitter.com/m2pfintech" target="_blank" rel="noreferrer noopener">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

How to block Android App installation in a Rooted Device

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/03/MicrosoftTeams-image-11-1.webp" alt="M2P Fintech" title="" id="kkcc1k5hr" width="100%" height="317">Video KYC is a game changer in digital onboarding. Since 2020, video-based identity verification has been effective in preventing fraud, reducing onboarding costs, and speeding up the authentication process.&nbsp;&nbsp;A robust face liveness detection is a key part of the <a class="link" href="https://m2pfintech.com/blog/transform-digital-onboarding-with-vkyc/" target="_blank" rel="noopener">VKYC</a> process. It is basically a selfie-based check that scans the user’s facial expressions and blinking gestures to differentiate a real user from a fake impersonator or a bot.&nbsp;<h2 class="heading-node" id="m7mrkrgp6" style="text-align: justify">How can you Create a Robust Face Liveness Detection Application?&nbsp;</h2>There are several tools and technologies available in the market, but the simplest cost-effective method involves using Flutter and Google ML Kit. Using these, you can easily create a face liveness detection application.&nbsp;Wonder how? &nbsp;We have our Flutter experts <a class="link" href="https://www.linkedin.com/in/chinnadurai-viswanathan-b2b6b7a5/" target="_blank" rel="noopener">Chinnadurai Viswanathan</a> and&nbsp;<a class="link" href="https://www.linkedin.com/in/nandhakumar-k-14828813a/" target="_blank" rel="noopener">Nandhakumar Krishnan </a>explain how a face liveness detection application can be created using Google ML Kit. &nbsp;So, here you go. &nbsp;To start with, facial&nbsp;images will be detected by doing the following gestures.<ol class="list-node" id="kg1t9mjv2"><li>Left - Turn&nbsp;</li><li>Right - Turn&nbsp;</li><li>Look - UP&nbsp;</li><li>Look - Down&nbsp;</li><li>Wink 😉&nbsp;</li><li>Smile 😃&nbsp;</li></ol>We will use Google’s library named <a class="link" href="https://firebase.google.com/docs/ml-kit" target="_blank" rel="noopener">Firebase ML Kit</a> to detect the faces within an image. <a class="link" href="https://pub.dev/packages/camera" target="_blank" rel="noopener">CameraPreview</a> is used to capture the user’s image, and then it will be sent to the <a class="link" href="https://firebase.google.com/docs/ml-kit" target="_blank" rel="noopener">Firebase ML Kit</a> library, which provides the face values.&nbsp; &nbsp;Now, let’s explore the Firebase ML Kit further.&nbsp;<h2 class="heading-node" id="ecwzez33o" style="text-align: justify">Firebase ML (<a class="link Hyperlink SCXW22502046 BCX0" href="https://firebase.google.com/docs/ml-kit" target="_blank" rel="noreferrer noopener">Firebase ML Kit</a>):&nbsp;</h2>Firebase ML Kit’s Face Detection API is a powerful tool to&nbsp;detect faces within images, which allows you to identify important facial features and obtain the contours of detected faces.&nbsp;&nbsp;This technology performs exceptionally well in the pre-processing phase of the image and detects different zones of the face accurately. The API can also identify many facial expressions and emotions, making it a valuable tool for developers looking to create facial recognition with greater accuracy and precision.&nbsp;&nbsp;After the images are captured from <a class="link" href="https://pub.dev/packages/camera" target="_blank" rel="noopener">CameraPreview</a>, it is tested using the following dependencies.&nbsp;<ol class="list-node" id="7f90uhnxd"><li><a class="link" href="https://pub.dev/packages/google_ml_kit" target="_blank" rel="noopener">Google MLKit (google_mlkit)</a>&nbsp;</li><li><a class="link" href="https://pub.dev/packages/camera" target="_blank" rel="noopener">Camera (camera)</a>&nbsp;</li></ol><h2 class="heading-node" id="pv2dvk5be" style="text-align: justify">Flutter Dependencies&nbsp;</h2><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/03/1.webp" alt="M2P Fintech" title="" width="100%" height="120"><h2 class="heading-node" id="d7sjvjvno" style="text-align: justify">Android Dependencies&nbsp;</h2><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/03/2.webp" alt="M2P Fintech" title="" width="100%" height="91"><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/03/3.webp" alt="M2P Fintech" title="" width="100%" height="117"><h2 class="heading-node" id="i0796e05v" style="text-align: justify">How to Get Face Values using Flutter &amp; Android dependencies?</h2>The following steps will help you get face values using Flutter and Android dependencies.&nbsp;Step 1The first step is to set the preview of the camera in Flutter.&nbsp;&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/03/4.webp" alt="M2P Fintech" title="" width="100%" height="120">In Flutter, the camera controller needs 3 parameters.&nbsp;<ol class="list-node" id="aj57jbroc"><li>List of cameras (List&lt;CameraDescription&gt; cameras = [];)&nbsp;</li><li>Resolution of Photo&nbsp;</li><li>Audio needs — Based on your requirement&nbsp;</li></ol><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/03/5.webp" alt="M2P Fintech" title="" width="100%" height="189">Using StreamBuilder, we can get the photo from the camera every second to process the images.&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/03/6.webp" alt="M2P Fintech" title="" width="100%" height="104">The cameraController?.startImageStream() method returns a ‘CameraImage’ which can be used for ML image processing. If you use Firebase ML for Flutter, you can directly pass the CameraImage to it for processing. Once the processing is complete, you can return the result and display it in a User Interface (UI).&nbsp;&nbsp;Note: The ‘cameraController?.startImageStream()’ method provides ‘CameraImage’ instance, but Google ML Kit requires an ‘InputImage’ object to perform face detection. Therefore, we need to convert the ‘CameraImage’ to an ‘InputImage’ object to build the face detection logic. In case you’re not familiar with ‘InputImage’, it is an ML Kit class that offers a common representation of images used as input data for machine learning models. It can be created from various sources such as bitmap, media image, or Byte Buffer.&nbsp;&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/03/7.webp" alt="M2P Fintech" title="" width="100%" height="74">Step 2Once you have implemented the above code, you can design your camera view in your application.&nbsp;&nbsp;Note: The below onImage method code is our special requirement, so we’ve implemented a few things.&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/03/8.webp" alt="M2P Fintech" title="" width="100%" height="454">Now we have obtained the InputImage from the camera stream, then the next step is to process the image and detect faces using the FaceDetector from the google_mlkit_commons library. This will display a list of all the faces present in the image, that can be used for further processing.&nbsp;&nbsp;Step 3Using this faceDetector instance, we will get the list of faces from InputImages objects.<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/03/9.webp" alt="M2P Fintech" title="" width="100%" height="368">The output of the image will be as below.&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/03/MicrosoftTeams-image-9.webp" alt="M2P Fintech" title="" width="100%" height="254">If you are interested in reusing the above codes in your existing native applications, you can refer to this article on <a class="link" href="https://m2pfintech.com/blog/the-implications-of-flutter-in-fintech/" target="_blank" rel="noopener">The Implications of Flutter in Fintech</a>.&nbsp; With the power of ML and Flutter, the possibilities are endless for creating intelligent apps that offer a better user experience.&nbsp;&nbsp;If you want to know more about how we implement face liveness detection in Flutter and Google ML Kit, write to us at <a class="link" href="mailto:business@m2pfintech.com" target="_blank" rel="noopener">business@m2pfintech.com</a>!&nbsp;This article is authored by <a class="link" href="https://www.linkedin.com/in/chinnadurai-viswanathan-b2b6b7a5/" target="_blank" rel="noopener">Chinnadurai Viswanathan</a>.<a class="link" href="https://m2pfintech.com/newsletter/" target="_blank" rel="noopener">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/" target="_blank" rel="noopener">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech" target="_blank" rel="noopener">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Unmask Face Liveness Detection by Integrating Google ML Kit into your Flutter App

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Hardware-Security-Modules-01-1.webp" alt="M2P Fintech" title="" width="100%" height="284">Security compliance is non-negotiable. No matter what.Irrespective of whether you are into digital banking, card issuance, or <a class="link" href="https://m2pfintech.com/blog/digital-lending-open-credit-enablement-network/">lending</a>, you must remember that your customer data, credentials, and documents are vulnerable to security hazards. Without strong <a class="link" href="https://m2pfintech.com/blog/why-is-risk-based-authentication-rba-critical-for-banks/">risk management</a> measures, you may risk exposing yourself and your customers to data breaches, cyber-attacks, and exorbitant fines from regulatory authorities. This is where cryptography, the science of protecting sensitive data saves the day, by delivering the highest levels of data protection.<h2 class="heading-node" id="q22mmnm3s">Cryptographic Keys</h2>Cryptography uses digital keys to encrypt and decrypt data with required levels of complexity for secure access and compliant operations.So, what is a cryptographic key?A cryptographic key refers to a string of characters in an encryption algorithm that helps randomly create the desired data. This key helps convert a plain text to ciphertext and vice-versa whenever data encryption and decryption happens. Efforts must ensure that only the authorized user has access to the key. The encrypted data must be stored securely for decryption without any discrepancy.<h2 class="heading-node" id="5d58">Lifecycle of a Cryptographic Key</h2> The following process comprises the cryptographic key lifecycle.<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Hardware-Security-Modules-02.webp" alt="M2P Fintech" title="" width="100%" height="285">Provisioning -The provisioning process generates keys using a key management system, an hardware security module (HSM), or a Trusted Third Party (TTP) through random number generators. The keys should be strong enough to provide the necessary protection to secure the data.Backup and storage-&nbsp;This is a critical step where a secure backup copy of the key is made. It should be available for future retrieval if the key undergoes any failures. Such backup keys are often stored in external media or other backup solutions. All private keys must be encrypted before being stored.Deployment-&nbsp;The&nbsp;new key is installed electronically or manually into a secure cryptographic devices such as Hardware Security Module.Management, Monitoring, and Rotation-&nbsp;Here, the keys are often controlled and monitored with respect to the industry standards and policies. The encryption key management system handles key rotation and deploys new keys as and when existing keys expire.Archiving-&nbsp;The keys that are no longer in operation are stored here for an extended period. They might be required again in the future for associated data retrieval. The key, when archived, is encrypted for additional security.Disposal-&nbsp;The keys are permanently destroyed here, when they are no longer needed. Before destruction, the key is analyzed and sometimes recovery is processes if necessary. A key can be removed from its operation using key destruction, key deletion, or key termination.Generating, securing, and managing cryptographic keys can be multifaceted and complex, requiring support from information security and development teams.So, how can you create, monitor, store, and optimally use cryptographic keys?Simple. Install HSM.<h2 class="heading-node" id="a893">So, what is Hardware Security Module (HSM)?</h2>Hardware Security Module (HSM) is a device that provides a wired security solution for the wireless world. It is a dedicated cryptographic processor that offers a secure, tamper-resistant environment specifically designed to protect identities, devices, and cryptographic key data throughout its lifecycle.HSM protects any data in use, transit, and rest, for encryption, decryption, authentication, and key management. In toto, it serves as a ‘trust anchor’ to ensure compliance, simplify audits, generate, and store keys.<h2 class="heading-node" id="6380">Types of HSMs</h2>HSMs can be broadly classified (as listed below) based on the levels of functionality and compliance with different security standards.· General Purpose (GP) HSM· Transaction HSMGeneral Purpose (GP) HSMWherever there is sensitive data, and the need for encryption prevails, GP HSM is indispensable. It generates powerful cryptographic commands that can safely encrypt and decrypt information for any application.Sample use cases for general purpose HSM are:· Symmetric key management for database encryption· Asymmetric keys management for digital signature creation· Certificates to support Public Key Infrastructure (PKI)· Crypto walletsGP HSM supports compliance with the following standards.· <a class="link" href="https://m2pfintech.com/blog/pci-dss-a-quick-guide-to-its-levels/">PCI DSS (Payment Card Industry Data Security Standard)</a>· <a class="link" href="https://m2pfintech.com/blog/prevent-cnp-frauds-with-pci-3ds/">PCI 3DS (Payment Card Industry 3-Domain Secure)</a>· <a class="link" href="https://m2pfintech.com/blog/gdpr-in-a-nutshell/">GDPR (General Data Protection Regulation)</a>· FISMA (Federal Information Security Management Act)· FedRAMP (Federal Risk and Authorization Management Program)· ICAM (Identity, Credential, and Access Management)· eIDAS (Electronic Identification and Trust Services)Transaction HSMAlso known as payments HSM, this security module has advanced security features compared to the general-purpose counterpart. Transaction HSM enforces dual control using payment-specific cryptographic commands to ensure sensitive information never leaves the HSM. The PCI SSC compliance mandates the use of payments HSM for the use cases below.· When payment transaction processing happens, this supports card, user and cryptogram validation· Helps in processing EMV transactions· Generates key and injects it· Helps facilitate highest security when keys are shared with third parties· Used for generating, managing, and validating PIN· Enables electronic funds interchange, Electronic funds transfer at point of sale (EFTPOS), and ATM transactions· For payment cards and mobile applications, it helps in generation of payment credentials· Enables point-to-point encryption (P2PE), key management and secure data decryption· With payment HSM, cash-card reloading is made hassle-free· Facilitates PIN block translation when network switch of POS and ATM transaction takes placeTransaction HSM supports compliance with the following standards:· PIN (Personal Identification Number) Security· P2PE (Point-to-Point Encryption)· <a class="link" href="https://m2pfintech.com/blog/3d-secure-your-barrier-against-cyber-attacks/">3DS (ACS- Access Control Server &amp; DS- Directory Server)</a>· Card Production· TSP (Token Service Provider)· SPoC (Software-Based PIN Entry on COTS)· CPoC (Contactless Payments on COTS)<h2 class="heading-node" id="5938">Are HSMs trustworthy?</h2>Absolutely!HSMs have high accuracy and are implanted in a secure and sealed environment. This acts as the trust factor for every organization to implement. As HSMs work on a dedicated firewall, they never get exposed to the public internet and thus ensure maximum security. The hardware is designed to give a high input with minimal resource usage. This is how cryptographic keys and data are protected optimally.<h2 class="heading-node" id="47c2">High on protection</h2>HSMs are commonly used to protect identities, transactions, and applications. They protect the cryptographic keys by creating a trustable environment in which processes such as encryption, decryption, and authentication are equipped and secured. They follow industry regulations and standards such as <a class="link" href="https://m2pfintech.com/blog/pci-dss-a-quick-guide-to-its-levels/">PCI DSS</a>, FIPS 140–2, European Union’s General Data Protection Regulation, Domain Name System Security Extensions, and Common Criteria.<h2 class="heading-node" id="6534">How HSM enables maximum security?</h2>HSMs offer the ultimate protection for all the critical functions involved in payment applications and databases. Hardware Security Modules come with many features that cannot be overlooked, as they help organizations maintain a secure transaction infrastructure.· HSMs are equipped with a secure design that meets all the security standards and adheres to the Federal Information Processing Standardization (FIPS) 140–2.· The operating system in HSM is always security-focused.· The higher levels of trust and authentication ensure the maximum security of the sensitive data and cryptographic keys.· Automated lifecycle tasks and protective mechanisms are quick and efficient.· The key is maintained only in the HSM, exempting the possibility of malicious attacks that might occur virtually.· HSMs enable application integration with the help of <a class="link" href="https://m2pfintech.com/blog/the-world-of-apis-how-they-power-fintech/">APIs.</a><h2 class="heading-node" id="6d7a">Versatility of HSMs</h2>Businesses should use HSMs to safeguard the sensitive information pried by countless threats they might encounter. In day-to-day applications, HSMs secure data generated across banks, websites, cryptocurrencies, smart meters, mobile payments, medical devices, PINs, identity cards, and digital documents.And the buck doesn’t stop here. HSM protects digital signing, ensures compliance, and helps in key generation and management. Wherever financial transactions happen, HSMs provide that additional layer of security. ­­­Today physical HSMs are transitioning to the cloud. Cloud HSM or HSM as a Service (HSMaaS) hosts encryption keys and cryptographic operations with FIPS 140–2 Level 3 certified modules.Want to know more about HSMs?Contact us at&nbsp;<a class="link" href="mailto:business@m2pfintech.com">business@m2pfintech.com</a><a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox. Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Cryptographic Keys and Hardware Security Modules - An Introduction

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/Android-SDK-Integration-Blog-Banner-Design-01-2.webp" alt="M2P Fintech" title="" id="8wwgsm7pp" width="100%" height="358">Flutter combines the best features from native and hybrid application development approaches.&nbsp; Instead of developing separate apps for platforms such as Android, iOS, Windows, and Linux, Flutter allows developers to build once and deploy across multiple platforms.&nbsp; But how can developers tap into native platform features and integrate robust SDKs?&nbsp; Enter the Method Channel Method Channel acts as a powerful communication mechanism between Flutter and the native platform, opening a world of possibilities for an app. By leveraging the Method Channel, a developer can seamlessly integrate iOS and Android SDKs into their Flutter project, unlocking new functionalities and expanding their app's potential.&nbsp; In this blog, our developer <a class="link" href="https://www.linkedin.com/in/alwin-s-699a47145/">Alwinraj Sahayaraj </a>delves into the exciting world of SDK integration in Flutter using Method Channels. He will guide you through the process of integrating SDKs, accessing native functionalities, and creating a seamless bridge between Flutter and the native platform.&nbsp; Let's start with what an SDK is.&nbsp;<h2 class="heading-node" id="q0pkxgv2y" style="text-align: justify">What is SDK?&nbsp;</h2>Software Development Kit (SDK) or devkit is a set of software tools and programs that developers use to create applications for specific platforms.&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/Android-SDK-Integration-Blog-Banner-Design-05.webp" alt="M2P Fintech" title="" width="100%" height="348">SDK is like a magical toolbox that comprises everything a developer needs to bring their app ideas to life on a particular platform. This toolbox includes libraries, documentation, code samples, processes, and guides that developers can use and integrate into their own apps.&nbsp;&nbsp; SDKs are created to be used for particular platforms or programming languages.&nbsp; When developing an Android application, you would require an Android SDK toolkit, while an iOS SDK would be necessary for building an iOS app. &nbsp; Similarly, a VMware SDK would be essential if you intend to integrate with the VMware platform. Likewise, a Nordic SDK would be the appropriate choice for developing bluetooth or wireless products. The specificity of SDKs ensures developers have the tools tailored to their intended platform or technology.&nbsp; Now, let’s see how SDK is integrated into Flutter.&nbsp;&nbsp;<h2 class="heading-node" id="3jyfvdfuq" style="text-align: justify">SDK Integration into Flutter&nbsp;</h2>SDK integration in Flutter involves integrating external development kits into your Flutter project. These SDKs are pre-built libraries or tools offering additional features or services not native to the Flutter framework. &nbsp; They are developed in different programming languages like Dart, Swift, Objective-C, Java, or Kotlin. Incorporating these SDKs into your Flutter project allows you to access extended functionality and leverage existing libraries and tools to enhance your app development process.&nbsp; SDK integration enables you to create a feature-rich, dynamic, and user-friendly app. Built on multiple programming languages, they are compatible with different platforms.&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/Android-SDK-Integration-Blog-Banner-Design-04-1.webp" alt="M2P Fintech" title="" width="100%" height="358">SDK integration in Flutter enables developers to leverage native platform features, tap into third-party services, and extend the capabilities of their applications. It empowers developers to improve user experience and accelerate the development process by leveraging the power of tailored SDKs.&nbsp; Some everyday use cases of SDK integration in Flutter include the following.&nbsp;<h3 class="heading-node" id="1rl0ilk7q" style="text-align: justify">Native Functionality Interaction&nbsp;</h3>Flutter offers a robust platform channel mechanism that facilitates seamless communication between Flutter and the native iOS or Android platform. By integrating SDKs, developers can interact with device-specific functionalities like the camera, GPS, sensors, Bluetooth, and other native APIs.&nbsp;<h3 class="heading-node" id="gvkzzp708" style="text-align: justify">Third-Party Service Access&nbsp;</h3>Numerous SDKs provide consistent integrations with widely used third-party services, including analytic platforms, push notification services, authentication providers, payment gateways, and social media networks. By integrating these SDKs into your Flutter app, you can effortlessly incorporate these essential services, enabling features such as user analytics, real-time notifications, secure authentication, streamlined payments, and seamless social media integration.&nbsp;<h3 class="heading-node" id="dbnbidppe" style="text-align: justify">Readymade UI Components&nbsp;&nbsp;</h3>Specific SDKs offer ready-made UI components that can be integrated into your Flutter app, saving valuable time and effort. These pre-built components enable you to swiftly achieve desired designs or functionalities without creating them from scratch. By leveraging these UI components, you can expedite the development process, enhance the visual appeal of your app, and ensure consistency across different screens and interactions.&nbsp;<h3 class="heading-node" id="diq0c199q" style="text-align: justify">Optimize Performance&nbsp;&nbsp;</h3>SDK integration geared towards performance optimization can significantly boost the overall performance, reduce network usage or improve the overall rendering efficiency of your app. You can optimize various aspects of your app's functionality by integrating performance-focused SDKs, such as image processing libraries, networking libraries, or caching mechanisms.&nbsp;<h3 class="heading-node" id="wywpa3xti" style="text-align: justify">Monetization Opportunities&nbsp;&nbsp;</h3>SDK integration with advertising networks or in-app monetization platforms offers a seamless solution to incorporate various monetization strategies into your app. By integrating these SDKs, you can display targeted ads, track important metrics such as ad impressions and revenue, and implement in-app purchases and subscriptions seamlessly.&nbsp; One of the most effective ways to achieve seamless SDK integration in Flutter is using Method Channels. &nbsp;<h2 class="heading-node" id="cesqxp4wy" style="text-align: justify">What is Method Channel &amp; how it is used in SDK integration?&nbsp;</h2>The Method Channel is like a virtual bridge that connects your Flutter app with the native platform, whether it's Android or iOS.&nbsp;&nbsp; Using the Method Channel, you can invoke platform-specific code from your Flutter app and receive the corresponding results. This bidirectional communication mechanism facilitates data exchange and functionality between Flutter and the native platform.&nbsp; &nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/Android-SDK-Integration-Blog-Banner-Design-06.webp" alt="M2P Fintech" title="" width="100%" height="360">Within the Flutter/services package, you'll find the Method Channel class, crucial in establishing a communication channel between your Flutter app and the native platform. This channel facilitates the invocation of methods and the handling of results, enabling seamless interaction between Flutter and the underlying native platform.&nbsp; Let's see how the code is integrated into Flutter. To integrate SDKs using Method Channels in Flutter, there are a few steps to be followed on both the Flutter side and the native (Android and iOS) platform side.&nbsp;&nbsp; First, let’s see the flutter side.&nbsp;<h2 class="heading-node" id="iah66oac6" style="text-align: justify">Flutter&nbsp;</h2>To use the Method Channel in Flutter for SDK integration, here is the fundamental structure for creating and invoking a Method Channel in Flutter and iOS.&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/MicrosoftTeams-image-15.webp" alt="M2P Fintech" title="" width="100%" height="508"><h2 class="heading-node" id="v9wvbfq7n" style="text-align: justify">Native (Android + iOS)</h2>On the native side (iOS), specifically inside the AppDelegate file, you would typically implement the Method Channel functionality. This is where you handle method invocations from the Flutter app and establish communication between Flutter and the iOS platform.&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/MicrosoftTeams-image-18.webp" alt="M2P Fintech" title="" width="100%" height="1422">The following is the basic structure for creating and invoking a Method Channel in Flutter and iOS:&nbsp;<h2 class="heading-node" id="oo9beyl71" style="text-align: justify">Android&nbsp;</h2>On the Android native side (MainActivity.kt), you can set up the Method Channel.<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/MicrosoftTeams-image-20.webp" alt="M2P Fintech" title="" width="100%" height="84">To integrate the SDK on the Android side, you need to perform the following steps:&nbsp; Step 1: Add the AAR file to your project: Navigate to the project directory: Project → android → app → lib (create the "lib" directory if it doesn't exist).&nbsp; Place the AAR file inside the "lib" directory&nbsp; Step 2: Modify the build.gradle file (app level):&nbsp; Open the build.gradle file located at: Project → android → app → build.gradle.&nbsp; Step 3:&nbsp; And need to add the required dependencies for SDK integration (mentioned in the SDK documents)&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/06/MicrosoftTeams-image-16.webp" alt="M2P Fintech" title="" width="100%" height="731">You will need to do the following to incorporate this functionality into your Flutter app.&nbsp; Step 1: Review the SDK Integration Document provided by the SDK developer before proceeding with the implementation. This document contains essential information and instructions on how to integrate the SDK into your application effectively.&nbsp; Step 2: If the SDK Integration Document specifies any required API calls and data retrieval, it is essential to follow those instructions. These API calls will enable you to fetch the necessary data to be passed as arguments to the SDK integration scenario.&nbsp; Step 3: To pass values from Flutter to iOS after retrieving them via an API call, you need to write an API call function in Flutter. This function will make the necessary HTTP requests and fetch the required data. Once the data is obtained, you can pass it as arguments to the SDK integration in Flutter. These arguments will be subsequently sent from Flutter to the iOS platform.&nbsp; By following these steps and carefully reviewing the SDK Integration Document, you can successfully incorporate the required API calls and data retrieval processes into your Flutter app, ensuring smooth integration with the SDK.&nbsp; So, whether you're a seasoned developer or just starting your Flutter journey, don't hesitate to explore the vast world of SDKs and the Method Channel.&nbsp;&nbsp; Happy Coding and Integrating&nbsp; Do you have any questions or suggestions?&nbsp; Write to us at <a class="link" href="mailto:business@m2pfintech.com">business@m2pfintech.com</a>. Our expert team will be happy to assist you.&nbsp; <a class="link fui-Link ___1idfs5o f3rmtva f1ewtqcl fyind8e f1k6fduh f1w7gpdv fk6fouc fjoy568 figsok6 f1hu3pq6 f11qmguv f19f4twv f1tyq0we f1g0x7ka fhxju0i f1qch9an f1cnd47f fqv5qza f1vmzxwi f1o700av f13mvf36 f1cmlufx f9n3di6 f1ids18y f1tx3yz7 f1deo86v f1eh06m1 f1iescvh ftqa4ok f2hkw1w fhgqx19 f1olyrje f1p93eir f1h8hb77 f1x7u7e9 f10aw75t fsle3fq f17ae5zn" href="https://m2pfintech.com/newsletter/" target="_blank" rel="noreferrer noopener">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox. Follow us on&nbsp;<a class="link fui-Link ___1idfs5o f3rmtva f1ewtqcl fyind8e f1k6fduh f1w7gpdv fk6fouc fjoy568 figsok6 f1hu3pq6 f11qmguv f19f4twv f1tyq0we f1g0x7ka fhxju0i f1qch9an f1cnd47f fqv5qza f1vmzxwi f1o700av f13mvf36 f1cmlufx f9n3di6 f1ids18y f1tx3yz7 f1deo86v f1eh06m1 f1iescvh ftqa4ok f2hkw1w fhgqx19 f1olyrje f1p93eir f1h8hb77 f1x7u7e9 f10aw75t fsle3fq f17ae5zn" href="https://www.linkedin.com/company/m2pfintech/mycompany/" target="_blank" rel="noreferrer noopener">LinkedIn</a>&nbsp;and&nbsp;<a class="link fui-Link ___1idfs5o f3rmtva f1ewtqcl fyind8e f1k6fduh f1w7gpdv fk6fouc fjoy568 figsok6 f1hu3pq6 f11qmguv f19f4twv f1tyq0we f1g0x7ka fhxju0i f1qch9an f1cnd47f fqv5qza f1vmzxwi f1o700av f13mvf36 f1cmlufx f9n3di6 f1ids18y f1tx3yz7 f1deo86v f1eh06m1 f1iescvh ftqa4ok f2hkw1w fhgqx19 f1olyrje f1p93eir f1h8hb77 f1x7u7e9 f10aw75t fsle3fq f17ae5zn" href="https://twitter.com/m2pfintech" target="_blank" rel="noreferrer noopener">Twitter</a> for insightful fintech bytes curated for curious minds like you.

Product

About

Compliance

Resources