Android Certificate Pinning Done Right
Certificate pinning on Android with Network Security Config and OkHttp: which key to pin, why you need a backup pin, and how to rotate keys without locking users out.
What I pick up while building Android apps: reading ID cards over NFC, structuring modules, the open-source tools I maintain, and the bugs that only show up in production.
16 articles, newest first
Certificate pinning on Android with Network Security Config and OkHttp: which key to pin, why you need a backup pin, and how to rotate keys without locking users out.
Splitting an Android app into :app, :feature, :core and :data modules: dependency direction, api vs implementation, convention plugins, Hilt and navigation across modules.
Why NFC reads drop on Android, what TagLostException actually tells you, and how to recover safely: reader mode flags, IsoDep timeouts and a fresh BAC/PACE session.
How BAC derives its keys from the MRZ, why that allows offline brute force, what PACE does differently, and how an Android reader picks between them with JMRTD.
Moving a View-based Android app to Compose screen by screen: ComposeView and AndroidView, one shared theme, state at the boundary, RecyclerView, nested scrolling and tests.
Generating a Navigation Compose graph from a @Destination annotation with KSP and KotlinPoet: the processor, typed route arguments, the aggregating flag and the one-module limit.
How my single-user webmail works: a Cloudflare Email Worker for inbound mail, Brevo for outbound, plain JSON files for storage, and Next.js in Docker on a VPS.
How Passive Authentication checks eID data on Android: the SOD and its data group hashes, the CSCA trust chain and CRLs, and what it cannot prove.
How an eID chip is read on Android: reader mode and IsoDep, APDUs, BAC/PACE and secure messaging, data groups and Passive Authentication. Notes from building an eID SDK.
A production-ready Android security toolkit for real-world threats: root and tamper detection, integrity checks and the trade-off behind each signal.
There are many tasks we repeat throughout the day without even noticing. They seem small, but over time they accumulate, drain our mental…
An open-source AOP framework that pulls cross-cutting concerns like logging, retry and caching out of your business logic with simple annotations.
What I learned moving a project from RxJava to Kotlin Coroutines: migration basics, CoroutineScope and Dispatcher management, throttleFirst/collectFlow extensions and error handling.
How OnBackPressedDispatcher fixes the code duplication, lifecycle and memory-leak problems of onBackPressed, with Activity and Fragment examples and Kotlin extension functions.
How I ended up in computer engineering instead of medicine, and what the software world really looks like from the inside.
My first dataset: popular Windows apps scraped with Python and Selenium.
WORK TOGETHER
Looking for an Android engineer for your team, or someone to think through a technical problem with? Let’s talk.
Book a 30-minute conversation[email protected]All contact and podcast links