The podcast for SaaS CEOs who want to create a mobile app version of their service. You’ll learn about everything it takes to make a successful mobile app. You hear experts in fields like security, UX design, recruitment, product design, and more to help you move forward in your mobile app project.
The podcast Mobile App Makers is created by Olivier Destrebecq. The podcast and the artwork on this page are embedded on this page using the public podcast feed (RSS).
If you think that trying to increase your download numbers is the best way to monetize your app, then you’re wrong. Steve P. Young is an app developer and consultant who helps app makers to earn money from their creations. He specializes in unconventional strategies that boost app monetization.
Today on the Mobile App Makers podcast, I interview Steve and pick his brains on all things related to app monetization. You’ll learn the counterintuitive app monetization strategies that actually deliver revenue, which app stats are the most important to track, and why you might be wasting your time adding shiny new features to your app.
If you liked this episode then share it with a friend in the mobile app development world and make sure to subscribe or follow the Mobile App Makers podcast wherever you get your podcasts.
Timestamps
[0:37] Steve’s route from studying business to making an app to starting a podcast [2:36] The smart approach to starting a business... and the stupid approach
[3:39] Using case studies to back up your advice
[5:01] Steve shares the most counterintuitive bits of advice from the app world that actually work
[7:55] More downloads isn’t the way forward: What Steve suggests to actually monetize your app
[10:33] “You don’t need more features!!” A case study to prove that more features isn’t always what the end users wants
[14:14] Steve talks black hat strategies
[16:18] What tools and strategies help you to optimize retention?
[19:23] How Steve transitioned from app development into an app optimization consultant
[20:50] What Steve does with his own apps today
[21:45] Where to go to find out more about Steve Links
On today’s episode of the Mobile App Makers podcast, I talk no-code mobile apps with the CEO of Caddify, Justin Halfpenny. Caddify is a SAAS company that offers companion apps for physical devices such as cars and household appliances. They offer a platform for other companies to build an app from a spreadsheet, with customizable options to help you launch an app cheaply and quickly, without any developer knowledge.
Justin and I discuss the potential of no-code apps, which are a game changer in the world of app development. In the future, Justin envisages no-code apps playing an important role in the Internet of Things, helping the end users to understand and diagnose problems with their devices. However, there are drawbacks to using no-code apps too. Apps requiring different and more complex set-ups may not fit into the model of a no-code app design, although Justin outlines how some coding can be integrated into a no-code app.
I also asked Justin about the user experience on a no-code app, which is a crucial element in the success of any app. Justin has seen the evolution of mobile apps over the years and has focussed his UX strategy on giving the users the best onboarding experience possible within a no-code app framework, so that users feel confident about installing and beginning to use the app. We end the discussion by talking about how to build a mobile app that lasts, keeping user experience at the heart of your app design to make sure that your app will continue to meet your users’ expectations.
========== Timestamps ===========
[00:27] Justin introduces himself and talks about his background in mobile tech
[01:22] Digital companions for physical products
[02:37] How Caddify is making companion apps cheaper and easier
[03:57] Building an app without code
[05:20] The huge potential of no-code apps
[07:06] How can you maintain an app without code?
[09:50] Listing no-code apps on an app store
[11:30] What are the downsides of choosing a no-code app?
[12:55] Adding coding options to no-code apps
[14:10] How do users respond to no-code apps?
[15:59] How can you build an app that lasts?
[17:52] Where to go to find out more about Justin and Caddify
========== Links ==========
Mobile App Makers podcast website
Today I interview David Eberle, one of the founders of Typewise, the app that set out to redesign how we enter text into our phones. This presented many logistical challenges, from coding a keyboard in many languages to finding a way for the app to nest within other apps and be compatible with Android and Apple software.
David and I discuss the story of Typewise, from its inception as a two-person operation to where they are today as a 15-person company. David talks about his hiring process for the company and specifically for developer roles, going through all of the recruitment stages step by step, which is really essential knowledge for anyone thinking of bringing a full-time developer on to their team. David also talks about his experience of funding Typewise through a Kickstarter funding round, sharing insights on how to make a good promotional video and on getting the word out about the Kickstarter fund into the media to gain traction.
Once the app was launched, David and his team dealt with the blow of negative reviews of the beta phase of the app, particularly on iOS. Apple had recently launched the iPhone 6 which had a different screen rendering to the iPhone 5, meaning that the keyboard was the wrong size and some keys were hidden. Eventually, they were able to manage the problem by redeveloping the app, cutting out some of the more technical features to focus on creating an app that was more streamlined, which was better received by users.
This interview gives a great overview on launching a successful app, starting from scratch and building up towards managing a thriving company.
=================Timestamps================
[00:22] David introduces himself and talks about Typewise
[01:44] The issues of creating a keyboard app
[02:44] The starting point for Typewise
[04:46] Creating an app that lives within other apps
[05:50] Pivoting Typewise’s strategy
[06:30] Distributing Typewise via app stores
[08:09] The three avenues that Typewise is using to grow
[10:31] Growing Typewise from a two-person company to a 15-person company
[15:34] How to hire good developers
[18:01] Putting new developers on a probationary period
[20:22] Crowdfunding Typewise through Kickstarter
[25:25] Dealing with poor reviews on iOS
=================Links================
David on LinkedIn
Typewise App
Mobile App Makers podcast website
In today’s episode of the Mobile App Makers podcast, I talk with Rachael Lovallo. Although Rachael stumbled into mobile app testing by accident after completing a degree in mathematics, she has gone on to flourish in the field. She now works as a senior test engineer at Pulsara, a software company in the healthcare industry, and will also give a talk and host a panel at this year’s Pacific Northwest Software Quality Conference (PNSQC). Rachael has 10 years of experience in mobile app testing working on the web, desktop, and mobile projects and I was so happy to have a chance to pick her brains about it.
Rachael walked me through many aspects of mobile app testing, which is a crucial stage in app development. She shared her thoughts on the best ways to test apps in the pre-launch phase and gave me her number one tip on how to increase testing effectiveness. She also analyzed the positives and negatives of using automated testing software, which can really speed up the testing process but maybe doesn’t cover all of your testing needs.
At the end of the episode, Rachael gave some really useful advice about some of the more practical aspects of mobile testing, such as how to plan out testing when working with a fully remote team, which is something that a lot of app development teams have struggled with since the onset of the COVID-19 pandemic.
Lastly, she also touched on the optimal app development team structure to make sure that your app is built with quality baked into the process. This is essential listening for anyone working in the field of mobile app testing, and anyone who has a mobile app tester on their team!
=============Bio=============
Rachael Lovallo serendipitously stumbled upon software testing nearly a decade ago, while trying to figure out what to do with a Mathematics degree. Since then she has been omnivorous, spending time at companies large and small in industries from financial services to healthcare. She has tested everything from desktop to web to mobile applications, as well as dabbled in backend testing. She’s happiest when struggling to find efficient and elegant approaches to new challenges, wearing many hats at work, and collaborating with her team. She currently applies her skills as a Senior Test Engineer at Pulsara, a software company that connects healthcare teams to improve patient outcomes in time-sensitive emergencies.
=============Timestamps=============
[00:38] Rachael introduces herself and talks about how she got into mobile app testing
[01:36] Rachael’s forthcoming talk at PNSQC’s annual conference
[03:01] What do app testers bring to a team?
[05:15] What’s the best way to test a mobile app?
[07:49] The #1 way to optimize your app testing strategy
[08:27] Test parties: how to discover the end-user experience and bring new ideas to the table
[11:05] Organizing the ultimate test party
[12:07] The pluses and minuses of automated testing for mobile apps
[14:54] The hurdles of fully remote app testing, and how to overcome them
[17:03] How can a team lead the best support a mobile app testing and development team?
[17:48] The optimal team structure to make a great mobile app
[19:38] Where to go to find out more about Rachael and the PNSQC
=============Links=============
Mobile App Makers podcast website
In today’s episode of Mobile App Makers, I chat with Mike Hudson about app stores and app distribution. Mike has been involved in many areas of app development for over 15 years, beginning when he was still in school. Mike is now the CEO of GameBake, a game distribution software company that he co-founded.
Mike and I discussed how the world of app stores has changed, particularly in light of the recent rulings concerning antitrust lawsuits brought against Apple and the Google Play store. Today, the app store distribution market looks very different and Mike walked me through the global marketplace for apps, which varies a lot by region. This is essential listening if you’re about to launch an app, as targeting these different app store platforms could bring your app to a whole new audience.
Mike also introduced me to the concept of instant gaming, a huge development in distribution for mobile gaming apps. Instant gaming represents a massive opportunity for gaming apps to reach a wider audience and to increase social engagement between players. If you plan out your marketing strategy and integrate features from social media platforms correctly into your gaming app, you could be sitting on the next viral mobile game.
This is a great episode of Mobile App Makers for anyone who wants to learn more about where they should be listing their app to maximize install numbers.
============Bio============
With over 15 years of experience in the industry, Michael drives GameBake’s vision and builds relationships with world-class mobile game publishers, app stores, and advertisers as well as driving the company's operations towards success. He co-founded GameBake after experiencing firsthand the limitations of existing distribution and monetisation models for mobile games companies, ultimately causing him to shutter the development studios after more than decade of making games. This was the catalyst for GameBake, a powerfully simple distribution and monetisation solution that gives publishers the infrastructure and expertise to reach global markets and high-quality platforms beyond Google Play and the Apple AppStore, using only one simple open source SDK.
Michael’s passion for video games goes back to his teenage years when he created simple flash-based browser games from the bedroom of his family home. He subsequently forged a career in mobile games development, founding and leading his own studios. A massive fan of RTS games, Mike’s favourite video games come from the Age of Empire Series.
============Timestamps============
[00:44] Mike introduces himself and talks about his long career in mobile app development
[01:36] How the world of app distribution is changing
[05:13] The greatest barrier facing mobile app developers today
[07:50] How many app stores are there out there?
[08:18] The global market for app stores
[10:22] Instant gaming, the new app distribution channel
[11:33] Why add your app to multiple distribution channels?
[14:41] Should your gaming app be distributed via instant gaming or on an app store?
[16:55] Where to go to find out more about Mike and Game Bake
============Links============
Mobile App Makers podcast website
In this episode of Mobile App Makers, I have the chance to sit down with the talented Diana Moura, who has built up more than 7 years of expertise in the field of app store optimization (ASO). Diana is the ASO specialist for Kurve, a digital marketing agency and consultancy, where she has created ASO strategies to maximize ROI for her clients’ marketing budget.
As she explained to me, even though ASO is crucial to promoting an app, some start-ups don’t put enough time into developing their ASO strategy or they ignore it altogether, which could decrease potential download numbers. Luckily, Diana shared loads of great tips on ASO with me, from the best time to launch an ASO strategy to how to nail your keyword research.
We also discussed some of the logistics around building a solid ASO process, such as how to test your app performance on an app store and how to use keywords in different languages, even if your app isn’t yet available in that language. Another core component of ASO is your app’s ratings and reviews from customers and here Diana had some fantastic insights on how you can make sure that you get top scores from your users. She also named some of the best tools available for different aspects of ASO.
Make sure to listen right to the end of this episode to learn loads of great ways to improve your ASO strategy, whatever stage of app development you’re at. Plus, Diana and Kurve are giving away a free ASO audit just for listeners of the Mobile App Makers podcast, so make sure to find out how you can take advantage of this special offer and claim an ASO audit for your mobile app!
Timestamps
[00:58] Diana Moura introduces herself and discusses how she got into app store optimization
[02:49] What is app store optimization?
[04:50] Diana’s tips for keyword research
[06:36] How can you maximize your marketing budget to get more app downloads?
[08:50] When should you start optimizing your app store page?
[10:55] Optimizing for multiple app stores
[12:20] App rating and reviews: how important are they for your ASO strategy?
[13:16] The secret to getting good app ratings and reviews
[14:32] Diana’s favorite tools to use for ASO
[15:03] Testing, testing, testing: a key component of your ASO strategy
[16:38] How will Apple’s recent update to the Apple App Store affect ASO?
[18:00] Where to go to find out more about Diana
Links
Kurve website (mention the mobile app makers podcast for a free ASO audit)
Mobile App Makers podcast website
Today I talk with Yoann Deshaies, a mobile app monetization expert who’s currently working as a product manager at Purchasedly, a company dedicated to building and optimizing in-app subscription funnels for developers and corporations. Yoann has been in the field of apps for a long time, beginning first as a developer and then moving across to roles in-app products, where he aims to understand app user needs.
Yoann used to work as a product manager at the popular dating app Happn. He joined Happn shortly after they switched from an advertising to a subscription model of revenue generation, which changed both the app and the business strategy. Yoann walked me through some of the considerations Happn had to take into account because of this switch, from localizing pricing models to the complexity of in-app purchases. Despite the extra work, Yoann outlines the advantages that come with a subscription-based app, from developing a better relationship with mobile app users to greater engagement and retention. Furthermore, auto-renewal subscriptions can be a great way to generate profit from the app, especially with family plans. Yoann also shared the top tip he would give to any CFO considering switching to a subscription app model, which is definitely worth listening to.
This episode of Mobile App Makers is a great way to get thinking about how you can maximize the profits from your mobile app, and includes a lot of useful insights about what this business model will mean for your app development.
=============Bio===============
Yoann has unique experience in the dating apps industry. At Happn, he took responsibility for two crucial topics for a successful app: activation and conversion. He faced the challenges of that highly competitive market to bring Happn to the Top 3 french leading apps in terms of revenues. Prior to that, Yoann spent several years as a test engineer and a product owner on the customer portal for major carrier companies in Europe: Bouygues Telecom and Orange. He is now bringing all those Product Management skills and In-App Monetisation expertise to Purchasely build exclusive features and helping premium customers get the most out of it.
LinkedIn: https://www.linkedin.com/in/yoanndeshaies/
=============Timestamps===============
[00:49] Yoann introduces himself and talks about how he got into app monetization
[01:32] Why did Happn switch from an advertising to a subscription revenue model?
[02:42] Why is a subscription model better than a single-purchase app?
[03:59] Yoann’s number 1 tip for switching to a subscription app model
[05:24] The downsides of in-app purchases in subscription model apps
[07:25] Localizing subscription apps for different markets
[10:07] How will family sharing affect in-app purchases on the Apple App Store?
[13:19] Where to find out more about app monetization and Yoann
=============Links==============
Yoann on LinkedIn
Purchasedly blog
Mobile App Makers podcast website
Happen
In this episode, I interview Olivier Chiabodo CEO at The Explorers about his experience leading and creating the platform and apps for The Explorers.
We touch on:
=============Bio===============
Olivier Chiabodo is the CEO and Co-FOunder of The Explorers. After spending over 15 years working at one of the leading French television companies, he decided to start a company to create a video catalog of the world. As part of the voyage so far, his company received the Best Apple TV app award in 2019 and the apps have been featured multiple times.
LinkedIn: https://www.linkedin.com/in/olivier-chiabodo-995780a9/
=============Links==============
The Explorers: https://theexplorers.com
The explorers on twitter: @_TheExplorers
In this episode, I interview Wandrille Pruvot (CEO at XtraLife) about mobile app backends. We touched on:
=============Bio===============
Wandrille is the CEO of XtraLIfe. XtraLife provides backend as a service for games. He lived in 4 different countries and started in the mobile gaming industry back in 2001. Back then it was on black and white Nokia phones...
LinkedIn: https://www.linkedin.com/in/wandrille/
In this episode, I interview Greg Lhotellier about hiring and training during and past the pandemic. We talked about:
=============Bio===============
Greg has been an iOS developer for 10 years in early-stage startups in Paris and New York. In 2015, shortly after Swift was announced, he started going to lots of iOS meetups and iOS conferences in France and worldwide, as an attendee, as a speaker, and, ultimately, as the organizer of the iOS meetups in Paris.
In 2019 he launched Swift Jobs to help companies to recruit iOS developers and, more recently, to organize workshops on recent topics such as SwiftUI and Combine and with world-renowned trainers such as John Sundell or Vincent Pradeilles.
LinkedIn: https://www.linkedin.com/in/glhotellier
In this episode, I interview Jean François Grang, CEO @ Purchasely about mobile app subscriptions. We covered topics such as:
=============Bio===============
Jean François Grang is the CEO of Purchasely. He was one of the first 500 developers on the iPhone SDK beta program. He has developed multiple award-winning apps including The Explorers which received the Best Apple TV app Worldwide in 2019. IN his agency he developed many apps until he wanted to solve the “pain in the apps” that are subscriptions.
Twitter: @jfgrang
LinkedIn: https://www.linkedin.com/in/jeanfrancoisgrang/
=============Links==============
Purchasely: https://www.purchasely.com
In this episode, I interviewed Idriss Bellamine about his experience building a mobile app geared toward casinos.
He shared some great insights into how he built his development team, how rewriting part of the project is not always the best option, the importance of a great user experience and finally how going international changes a few things.
=============Bio===============
Idriss Bellamine is the CEO and cofounder of WeOpt.
=============Links==============
LinkedIn: https://www.linkedin.com/in/idriss-bellamine-a5797648/
WeOpt: http://www.we-opt.com/#/home
First land of poker: https://firstlandofpoker.com/en/
In this episode, I interview Mike Slone about product design for mobile apps in the airline industry. We explain what is Customer centricity, how being on the go impacts the expectation of travelers when it comes to mobile apps and how mobile can fit in a company's digital strategy.
=============Bio===============
Mike Slone is VP, Principal-Travel Retail at Pros (NYSE: PRO) after the acquisition of Travelaer SAS in August of 2019.
Mike has been working in the digital space for 20+ years and has a deep passion for human-centered design, experience research, and innovation in the travel industry.
When Mike is not helping airlines improve their Customer experience, he is busy traveling the world with his family, trying to become a better oil painter, and seeking to capture the northern lights in a photograph (30 trips to Iceland with no aurora photos). On the few days when he is not traveling, he is home practicing his French so that his kids and locals alike will stop giving him such a hard time.
If you are an airline and you want help with your Customer experience or finding an alternative to your current eCommerce software, booking engine, or online check-in- come see Mike in the south of France. Not only will he impress you with his knowledge of the airline industry, but he will take you out to lunch on the beach with a guarantee of sipping on a good rosé while viewing the Mediterranean.
Twitter: @mikeslone
LinkedIn: https://www.linkedin.com/in/mikebslone/
https://www.linkedin.com/company/pros/
In this episode, I interview Sven Schleier and Jeroen Willemsen about how to drive improvement to your mobile app security, the OWASP Mobile Application Security Verification Standard (MASVS).
=============Bio===============
Jeroen Willemsen is a Principal Security Architect at Xebia. Jeroen is more or less a jack of all trades with an interest in infrastructure security, risk management, and application security. With a love for mobile security, he enjoys sharing knowledge on various security topics.
LinkedIn https://www.linkedin.com/in/jeroen-willemsen/
OWASP's Slack: https://owasp.org/slack/invite
Sven Schleier is specialized in Application Security and has supported and guided software development projects for Mobile and Web Applications during the whole SDLC. Besides his day job, he is one of the core project leaders and authors of the OWASP Mobile Security Testing Guide and OWASP Mobile Application Security Verification Standard. Sven is giving talks and workshops about Mobile Security worldwide to different audiences, ranging from developers to penetration testers and students.
Linkedin: https://www.linkedin.com/in/sven-schleier/
Twitter: https://twitter.com/bsd_daemon
OWASP's Slack: https://owasp.org/slack/invite
=============Links==============
OWASP MASVS: https://github.com/OWASP/owasp-masvs
In this episode, I talked with Michael Blood about mobile app monetization. We cover topics like how to pick the best monetization, some of the latest trends and when do you have to pay Apple's and Google's cut.
=============Bio===============
Michael Blood is a serial entrepreneur and President of Matraex, a software development company located in Boise Idaho. With 20+ years of experience in computer software and developing websites and applications, Michael is a true industry leader and innovator. When he's not running Matraex or working on his entrepreneurial efforts, Michael can be found spending time with his family, mountain biking, or volunteering at local organizations.
Twitter: @michaelblood
LinkedIn: https://www.linkedin.com/in/mrblood/
In this episode, I interview Jeremy Paul about UI design for mobile apps. We talked about the difference between UX design and UI design, atomic design and whether you'll want a visual designer who specializes in mobile apps or not.
=============Bio===============
Jeremy's job consists of fighting chaos so humans can enjoy using the products he designs. To achieve this, he carefully crafts mobile & web user interfaces with simplicity and consistency in mind, using atomic design — a component-based method. Specialized in mobile app design since 2011, he also explores various techniques such as 3D and motion design, influencing his workflow in a very personal way.
Twitter: @jrmypaul
LinkedIn: https://www.linkedin.com/in/jrmypaul/
=============Links==============
Jeremy's online portfolio: https://jeremypaul.me
Monoqle website: https://monoqle.fr
Audrey Hacq's conference: PreviewPreview30:39Atomic Design - Audrey Hacq - WEB2DAY 2017YouTube · Web2dayJun 28, 2017
In this episode, I interview Robi Ganguly about how to make an app that customers love.
=============Quotes============
On how to create an app that customer love in the early days of an audio based fitness app: "I'd be focused on: did you get through this like the first step of listening to one of these workouts? Did you do understand it? Did it makes sense what I was trying to get you to do, you know, and if people tell you along the way that it wasn't clear to them or didn't make sense and they didn't get that aha moment of getting into what you thought was going to be good, you got to unpack that and that, I mean, I, I see this over and over again, apps of all nature that don't really help you understand what you're supposed to do and they don't get you that aha moment
So I think that would be the first place I would start. But then assuming that a group of your customers is actually using it, you start looking for not just did you understand it, it's did you enjoy it. Did you really? What was it about? You were drawn to that you liked, and so this is different, I think sometimes from how people in the early stages well will go through. And I say, OK, people are supposed to use it this way.
They're not using it or they are using it. Here are these metrics. And how do we funnel? I think a lot of times people will say, OK, let's go figure out all the problems. And I would say as soon as you have 10, 15, 20 people who are using what is the thing that draws you like what are you really attached to? What are you. Is something working there? And so, for example, if again, with your app, if you're talking about 10 or 15 people, they're like, oh, yeah, this is this is great, Just honing on what's great about it, oh, I love the audio cues. Oh, I love the time, it's only ten minutes. Oh I love that there's this type of workout. Oh I love the way that you express this thing and make it reasonably coachable, whatever it is. If you can pull out those themes and then say, OK, that's that's a strength, you can build on that. Right. Then your problems maybe in the onboarding, not getting everybody to get to be solved when they get into that. "
=============Bio===============
Robi Ganguly is the CEO and Co-founder of Apptentive, which recently made Deloitte's Technology Fast 500 list for the second year in a row. Founded in 2011, Apptentive's solution measures shifts in sentiment from customer experience to win back consumers and activate fans. Using intelligent tools and precise targeting, Apptentive helps enterprise brands capture actionable emotions and feedback from the 90 percent of consumer voices typically missed, and quickly turns that feedback into action. Apptentive gives marketers, product managers, and customer experience leaders the keys to their customers' hearts through historical insights into brand loyalty and shifting emotions to support customer-centric decisions.
Twitter: https://twitter.com/rganguly
LinkedIn: https://www.linkedin.com/in/robiganguly/
In this episode, I interview a mobile application developer and specialist recruiter, Maksymilian Majer. Maks and I discussed many aspects of mobile application development, beginning with his experience working with mobile app technologies such as Objective C, the Xamarin framework, Ionic, Cordova, React Native and Flutter. He also had a chance to share his opinions on working with Ionic React versus React Native and Flutter, and which of these he would pick to use for different mobile application projects.
Listen out also for the in-depth discussion that Maks and I had about his experience of recruiting for roles in mobile application development, which is one of his specialist subjects. This is an area that can be tricky to get right and there’s often a lot at stake, especially for start-ups. Maks outlined his thoughts on the different hiring processes for freelance developers versus those for hiring a developer as a full-time employee, and how you can make sure that you’ve found the right person for your mobile application development needs. Plus, he answered one of the most frequent and pressing questions in mobile application development today: who should you trust to build the first version of your mobile app?
Timestamps
[00:29] Maks introduces himself and talks about his background
[01:35] Maks list the different kinds of mobile applications he’s worked on
[03:16] Weighing up the best kinds of frameworks to use when building mobile applications
[05:58] Flutter versus Ionic and React Native
[06:33] Building a community around Ionic
[08:03] Recruiting for mobile application developers, full stack developers and more
[09:32] My top tip for recruiting a web developer for a start-up
[10:31] The pros and cons of working with Flutter
[12:18] How to hire and work with a freelance web developer
[15:00] Hiring a developer as a full-time employee
[17:20] Should you find a CTO co-founder or hire a freelancer to build the first version of your mobile application?
[21:51] Where to go to find out more about Maks
Links
Mobile App Makers podcast website
Bio
Maksymilian is a software engineer, technical lead, and entrepreneur. During his 16+ year career, he was building digital products ranging from early-stage startups to multinational corporations within telecom, pharma, and financial environments. For the past 6 years, he has been primarily engaged in hybrid mobile development. He also co-founded ITCraftship – tech-focused recruitment and staff augmentation agency, that uses agile in its recruitment processes.
In this episode, I interview Anastasiia Voitova about mobile security and the trade-offs it involves (cost, user experience, team collaboration). She has some great advice about how much to invest in your project. We talk about early start-up and try to give a good rule about how much to invest in security.
=============Bio===============
Anastasiia Voitova, Head of customer solutions, security software engineer at Cossack Labs, is a software engineer with 10+ experience years. She builds security tools for protecting data during the whole lifecycle (encrypt everything!). Anastasiia shares a lot about "boring cryptography", end-to-end encryption, data security, zero-knowledge & zero trust systems, software security architecture. She speaks at international conferences, conducts workshops and training for developers, and co-organizes cybersec events.
Twitter: https://twitter.com/vixentael
=============Quotes============
"Security is a process and this is a very long process. And there is not this and like table and ribbon, finish ribbon that says, yeah, you're done. Sorry, you're not done. You can do it all the time like month after month, year after year. So the question with security engineering is a question of tradeoff. How to put just enough money into security to have a secure application not to get into, you know, super paranoia mode, not to create applications that is very secure, but no one will use it. At the same time still invest money, because if you don't invest money and in security, it won't happen magically right now. So it's like a game with trade-offs."
"However, really scary things happen when it's not only about money, but it's more related to our physical life. For example, those mobile applications that can control automobiles, controlled cars. And now, especially electric or hybrid car. They have a mobile app that controls this car. And there were cases with Nissan Leaf, for example, where you can just get the application check the network connection from the app to the backend. Go to the Nissan Leaf parking lot and enumerate, like find a Nissan Leaf car ID, just by enumeration and you might be lucky. And there is this car in this parking lot with this ID and suddenly you can control someone else's car."
"Well, you know, like no one really aims to create insecure applications. So I don't know a lot of people whose goal was to create bad applications. OK, so it's not something that happens intentionally and it's not something that we can fix. And that's something that we can say to someone else, just like some person on our team, "Hey stop doing that". To do more secure applications, we need some kind of process that will integrate security into the life of our team, basically like day by day, week by week, as in a process that they can't run away from."
=============Links==============
Themis crypto lib: https://github.com/cossacklabs/themis
Cossack Labs blog: https://www.cossacklabs.com/blog
Security Workshop for devs: https://github.com/vixentael/security-data-management-for-app-devs-workshop
OWASP (Open Web Application Security Project) MASVS (Mobile Application Security Verification Standard): https://github.com/OWASP/owasp-masvs
NIST guidelines for passwords: https://pages.nist.gov/800-63-3/sp800-63-3.html
En liten tjänst av I'm With Friends. Finns även på engelska.