FAQ

The name of a wanted supported alternative store is in the form of its package name. You need to find out the package name of the application, which installs your application. For example, these are some package names of known alternative stores:

• com.xiaomi.mipicks

• com.vivo.appstore

• com.heytap.market

There are also some services, which use package installer for distribution of the application, e.g. the App Center uses com.google.android.packageinstaller or com.android.packageinstaller.

See Detecting unofficial installation for more information.

When you put a mail address into the watcherMail parameter in TalsecConfig. Talsec registers this mail address and sends regular (weekly) security reports describing the application's security state and the characteristics of the devices it runs on, e.g. how many devices are rooted or if your application has been tampered with. See theSecurity Reportchapter for more details.

The Dev version is used to simplify the development process of the application, e.g. if you would implement killing of the application on the debugger callback. It disables some checks which won't be triggered during the development process:

• Emulator

• Debugging

• Tampering

• Unofficial store

• Obfuscation Issues

• Developer Mode

If you want to use the Dev version to disable checks, you need to set isProd parameter to false in TalsecConfig object instance. By default, the isProd parameter is set to true.

The easiest way how to produce an incident (trigger local check and create a record in the security report) is to install a release build on an emulator (e.g., Android Emulator, that comes with Android Studio). Both the app and freeRASP must be in release mode. You can also use a rooted Android device/emulator, in which case you create an incident event in debug mode.

NB: Debugging detection is disabled in debug mode to prevent false positives.

Internally, there are two types of checks:

• one-time checks,

• periodic checks.

One-time checks are executed only once when the app is launched and wasn't running in the background.

Periodic checks are performed regularly, at defined intervals (e.g. every X seconds or minutes).

Currently, there is no way to set the order of threat detection for freeRASP. The checks are performed asynchronously on Android and synchronously on iOS. If a check fails, the corresponding callback is executed.

There are a few steps to take when you want to do this. You need to remove the old TalsecRuntime.xcframework and integration script from your project:

• Go to your project's ios folder.

• Open Runner.xcworkspace in Xcode.

• On the top bar select Product -> Scheme -> Edit Scheme....

• On the left side select Build -> Pre-actions.

• Find the integration script and click the trash icon on the right side to remove it.

• Open the .flutter-plugins (in the root folder of the app), and get the address where the freeRASP is installed.

• Go to the given folder, and remove the freerasp folder file.

• Delete .symlinks folder from project.

• Run pub get.

• Run pod install to test it.

It will mean that you violate the Fair Usage Policy. Currently, we are not enforcing strong limitations. Only:

• we may use the app name in our PR communications

• app security consolidated report can be stopped

This list of limitations is subject to change, and we plan to introduce additional requirements to be fulfilled over 100K downloads (like mentioning "Protected by freeRASP"). If these requirements are not fulfilled, the license for usage can be formally revoked.

Generally, we recommend upgrading to a Business RASP+ subscription over the 100K App downloads.

In our experience, integrating freeRASP typically results in a more modest increase of around 10 MB in the APK size, as seen in the example app in the freeRASP project.

Putting callbacks into multiple classes shouldn't cause any performance issues, but while the general idea of dissolving checks all over the codebase is valid, you won't get many advantages, as an attacker can still circumvent duplicate sections.