{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T19:01:59Z","timestamp":1782846119055,"version":"3.54.5"},"reference-count":61,"publisher":"JMIR Publications Inc.","issue":"10","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["JMIR Mhealth Uhealth"],"DOI":"10.2196\/mhealth.7791","type":"journal-article","created":{"date-parts":[[2017,10,18]],"date-time":"2017-10-18T10:45:09Z","timestamp":1508323509000},"page":"e147","source":"Crossref","is-referenced-by-count":33,"title":["Client-Focused Security Assessment of mHealth Apps and Recommended Practices to Prevent or Mitigate Transport Security Issues"],"prefix":"10.2196","volume":"5","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2991-3968","authenticated-orcid":false,"given":"Jannis","family":"M\u00fcthing","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4302-3395","authenticated-orcid":false,"given":"Thomas","family":"J\u00e4schke","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7906-0038","authenticated-orcid":false,"given":"Christoph M","family":"Friedrich","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1010","published-online":{"date-parts":[[2017,10,18]]},"reference":[{"key":"ref1","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-319-12817-7","author":"Adibi, S","year":"2015","journal-title":"Mobile Health: A Technology Road Map"},{"key":"ref2","doi-asserted-by":"crossref","DOI":"10.1007\/b137697","author":"Istepanian, RS","year":"2006","journal-title":"M-Health: Emerging Mobile Health Systems"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1001\/jama.2013.281078"},{"issue":"4","key":"ref4","doi-asserted-by":"crossref","first-page":"405","DOI":"10.1109\/TITB.2004.840019","volume":"8","author":"Istepanian, R","year":"2004","journal-title":"IEEE Trans Inf Technol Biomed"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.2979\/eservicej.9.2.1"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1162\/itgg.2009.4.1.103"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1016\/j.tele.2015.11.001"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.2196\/jmir.3133"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/WCRE.2012.18"},{"key":"ref10","unstructured":"Eur-lex.europa2016Regulation (EU) 2016\/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC http:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679&from=DE"},{"key":"ref11","unstructured":"European CommissionEc.europa20162017-03-30Privacy code of conduct on mobile health apps https:\/\/ec.europa.eu\/digital-single-market\/en\/privacy-code-conduct-mobile-health-apps"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.2196\/jmir.1164"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1370\/afm.1396"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/1629575.1629606"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2014.66"},{"key":"ref16","unstructured":"MehtaNHeartbleed20142017-03-10The Heartbleed Bug CVE-2014-0160 http:\/\/heartbleed.com"},{"key":"ref17","unstructured":"ShefferYHolzRSaint-AndrePTools.ietf20152017-09-18Summarizing known attacks on transport layer security (TLS) and datagram TLS (DTLS) https:\/\/tools.ietf.org\/html\/rfc7457"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/MS.2006.114"},{"key":"ref19","unstructured":"NovakJKrajncAZontarRTaxonomy of static code analysis tools201033rd International Convention MIPROMay 24-28, 2010Opatija, Croatia418422"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2004.111"},{"key":"ref21","unstructured":"StrafachWMedium20172017-02-0976 Popular apps confirmed vulnerable to silent interception of TLS-protected data https:\/\/medium.com\/@chronic_9612\/76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-2c9a2409dd1"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/2766498.2766522"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-30436-1_21"},{"key":"ref24","unstructured":"OWASP20162017-02-09Mobile top 10 2016 https:\/\/www.owasp.org\/index.php\/Mobile_Top_10_2016-Top_10"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382205"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.2196\/mhealth.3672"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.2196\/jmir.5955"},{"key":"ref28","first-page":"645","volume":"2014","author":"He, D","year":"2014","journal-title":"AMIA Annu Symp Proc"},{"key":"ref29","first-page":"294","author":"Gagnon, F","year":"2015","journal-title":"Foundations and Practice of Security"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.5220\/0005016500130020"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382204"},{"key":"ref32","unstructured":"FieldingRGettysJMogulJFrystykHMasinterLLeachPBerners-LeeTTools.ietf19992017-09-18Hypertext Transfer Protocol - HTTP\/1.1 https:\/\/tools.ietf.org\/html\/rfc2616"},{"key":"ref33","unstructured":"RescorlaETools.ietf20002017-09-18HTTP over TLS http:\/\/tools.ietf.org\/html\/rfc2818"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/TCOM.1980.1094702"},{"key":"ref35","unstructured":"MaurerUModelling a public-key infrastructure19964th European Symposium on Research in Computer Security: Computer SecuritySeptember 25-27, 1996London, UKUKSpringer-Verlag325350"},{"key":"ref36","unstructured":"HousleyRFordWPolkWSoloDTools.ietf19992017-09-18Internet X.509 public key infrastructure certificate and CRL profile https:\/\/tools.ietf.org\/html\/rfc2459"},{"key":"ref37","author":"Meyer, C","year":"2014","journal-title":"Information Security Applications. WISA 2013. Lecture Notes in Computer Science, Volume 8267"},{"key":"ref38","unstructured":"RizzoJDuongTPractical padding oracle attacks20104th USENIX Conference on Offensive Technologies2010Washington, DC"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.15"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23456"},{"key":"ref41","unstructured":"BrubakerCAndroid-developers20162017-02-09Changes to trusted certificate authorities in Android Nougat https:\/\/android-developers.googleblog.com\/2016\/07\/changes-to-trusted-certificate.html"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2014.2386139"},{"key":"ref43","doi-asserted-by":"crossref","unstructured":"JoshiJParekhCAndroid smartphone vulnerabilities: a survey2016International Conference on Advances in Computing, Communication, & Automation (ICACCA)April 8-9, 2016Dehradun, India","DOI":"10.1109\/ICACCA.2016.7578857"},{"key":"ref44","unstructured":"Statista20162017-03-01Distribution of Android operating systems used by Android phone owners in September 2017, by platform versions https:\/\/www.statista.com\/statistics\/271774\/share-of-android-platforms-on-mobile-devices-with-android-os\/"},{"key":"ref45","unstructured":"Apple20162017-02-13iOS security https:\/\/www.apple.com\/business\/docs\/iOS_Security_Guide.pdf"},{"key":"ref46","author":"Elenkov, N","year":"2014","journal-title":"Android Security Internals: An In-Depth Guide to Android's Security Architecture"},{"key":"ref47","unstructured":"EvansCPalmerCSleeviRTools.ietf20152017-09-18Public key pinning extension for HTTP https:\/\/tools.ietf.org\/html\/rfc7469"},{"key":"ref48","unstructured":"ChloeLabs.detectify20162017-02-13What HPKP is but isn't https:\/\/labs.detectify.com\/2016\/07\/05\/what-hpkp-is-but-isnt\/"},{"key":"ref49","unstructured":"KristolDMontulliLIetf19972017-09-18HTTP state management mechanism https:\/\/www.ietf.org\/rfc\/rfc2109.txt"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.49"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.01.013"},{"key":"ref52","unstructured":"FranksJHallam-BakerPHostetlerJLawrenceSLeachPLuotonenAStewartLTools.ietf19992017-08-14HTTP authentication: basic and digest access authentication https:\/\/tools.ietf.org\/html\/rfc2617"},{"key":"ref53","unstructured":"JonesMHardtDTools.ietf20122017-08-14The OAuth 2.0 authorization framework: bearer token usage https:\/\/tools.ietf.org\/html\/rfc6750"},{"key":"ref54","unstructured":"OWASP20162017-03-10OWASP zed attack proxy project https:\/\/www.owasp.org\/index.php\/OWASP_Zed_Attack_Proxy_Project"},{"key":"ref55","unstructured":"FieldingRTics.uci2000Irvine, CAUniversity of CaliforniaArchitectural Styles and the Design of Network-based Software Architectures https:\/\/www.ics.uci.edu\/~fielding\/pubs\/dissertation\/fielding_dissertation_2up.pdf"},{"key":"ref56","unstructured":"Github20172017-08-14BProxy - Client-focused transport security testing proxy https:\/\/github.com\/j4nnis\/bproxy"},{"key":"ref57","unstructured":"Appannie20172017-09-18Accelerate success for your app business https:\/\/www.appannie.com\/"},{"key":"ref58","unstructured":"Charlesproxy20172017-06-08Charles - Web debugging proxy application https:\/\/www.charlesproxy.com"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1145\/2565585.2565593"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-31680-7_1"},{"key":"ref61","unstructured":"JingXZhaofengCJimmySFireeye20162017-03-09Hot or not? The benefits and risks of iOS remote hot patching https:\/\/www.fireeye.com\/blog\/threat-research\/2016\/01\/hot_or_not_the_bene.html"}],"container-title":["JMIR mHealth and uHealth"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/mhealth.jmir.org\/2017\/10\/e147","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T18:05:27Z","timestamp":1782842727000},"score":1,"resource":{"primary":{"URL":"https:\/\/mhealth.jmir.org\/2017\/10\/e147\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,10,18]]},"references-count":61,"journal-issue":{"issue":"10","published-online":{"date-parts":[[2017]]}},"URL":"https:\/\/doi.org\/10.2196\/mhealth.7791","relation":{},"ISSN":["2291-5222"],"issn-type":[{"value":"2291-5222","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,10,18]]}}}