Securing the Ezio Mobile SDK for OATH OTP

The Problem

An OTP authenticator embedded in a third-party app runs on handsets the issuer does not control. Credentials on that device are only as safe as the SDK's storage, its API, and the app that calls it.

Constraints

• The SDK is consumed by many independent app teams, so its defaults must be safe even when integrators do not read the documentation.
• It must run across Android, iOS, and Windows with platform-specific secure storage.
• Backward compatibility with deployed apps limits how much the API can change.

Approach

• Designed token provisioning so credentials are bound to the app and stored through the platform's secure storage rather than in plain app data.
• Hardened the public API around common integration mistakes, with secure defaults over optional settings.
• Ran security reviews and threat modelling across the SDK life cycle, feeding findings back into the design.
• Integrated runtime protections into the SDK so that each integrating app does not have to build its own.

Outcome

• Shipped as an SDK that third-party apps integrate, so the security controls are built into the component rather than left to each integrating app.
• Carried the security review and threat-modelling work through the SDK's life cycle.

Technologies