{'fraction_non_alphanumeric': 0.015957446808510637, 'fraction_numerical': 0.0026595744680851063, 'mean_word_length': 5.135869565217392, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Supporting visual security cues for WebView-based Android apps

One of the most popular and powerful tools to develop Android apps is WebView, through which app developers can implement a functionally limited but versatile browser inside an app. However, unlike the traditional web browsers that support various visual security cues and alerts such as a padlock to inform users of the security status of current communications, Android apps using WebView do not support any of these. Hence, it is very unlikely that users are able to perceive imminent threats or to find out if they are accessing a legitimate website or submitting their login credentials on a secure channel such as SSL. In this paper we discuss an empirical study that analyzed 212 most popular Android apps to investigate their SSL support for authentication, visual security cue usage, and vulnerability to the man-in-the-middle (MITM) attack, especially the SSLstripping attack. Visual security cues for enabling better user perception and understanding of current security situations are proposed and a user study to test their effectiveness is discussed.