Shopify / mobile-buy-sdk-android

Shopify’s Mobile Buy SDK makes it simple to sell physical products inside your mobile app. With a few lines of code, you can connect your app with the Shopify platform and let your users buy your products using their credit card.
MIT License
216 stars 136 forks source link

ConfirmationPrompt on Android P #553

Open AlejandroHCruz opened 6 years ago

AlejandroHCruz commented 6 years ago

A new security feature of Android P is the ConfirmationPrompt:

API. By using this new API, your app can use an instance of ConfirmationPrompt to display a prompt to the user, asking them to approve a short statement. This statement allows the app to reaffirm that the user would like to complete a sensitive transaction, such as making a payment.

If the user accepts the statement, your app receives a cryptographic signature that's protected by a keyed-hash message authentication code (HMAC). The signature is produced by the trusted execution environment (TEE), which protects the display of the confirmation dialog as well as user input. The signature indicates, with very high confidence, that the user has seen the statement and has agreed to it.

Confirmation prompts are prompts shown to the user to confirm a given text and are implemented in a way that a positive response indicates with high confidence that the user has seen the given text, even if the Android framework (including the kernel) was compromised.

Are you planning on including it in your sdk?

Sources: 1 2