search

mobfox / MobFox-Android-SDK

26 stars 21 forks source link

Security/Vulnerability is raised in Google Play #54

Closed dakdroid closed 6 years ago

dakdroid commented 7 years ago

Copy/Paste from the console: Sending Advertising ID Your app is sending Advertising ID over an unencrypted connection.

This isn't recommended because network intermediaries might be able to intercept it. You should use an encrypted connection when sending Advertising ID.

I can see that the advertisement id in logcat, in the request params: {"s":...}.

nabriski commented 7 years ago

Hi,

Thanks, we'll try to do this in our next sprint. I can't do it with a simple change in the SDK as I also need server side cooperation.

rodrigograca31 commented 7 years ago

side note: I also have this error in Play Console but I'm only using AdMob and Amazon Mobile Ads....

It started to show after I added Amazon Mobile Ads but I think that it's not related to that...

rodrigograca31 commented 7 years ago

I thnik that it's related to the ad that is currently showing... In other words, AdMob is probably allowing HTTP and HTTPS and when some random ad uses HTTP the Play Console shows that error/warning...

nabriski commented 7 years ago

Hi,

Thanks for the info, I'll try to see if we can move our call to HTTPS by default.

nabriski commented 7 years ago

As for the ads themselves, this is not as simple as only working with secure ads will have an impact on the fill rate.

nabriski commented 7 years ago

ok, our testing tools are finally upgraded to test SSL connections, this was holding back the change. I'll add it on our next release.