Five tips to secure your app (Firebase Summit 2018)

In a world where security breaches make the front page of newspapers, how do you ensure high velocity without compromising application security? In this talk you'll learn about common application threat models, and how you can use the tools provided in Firebase to secure your apps. We'll share best practices for writing Security Rules, and how to configure IAM for least privilege access. We'll also talk about all the work Firebase automatically does for you to keep your app secure.

Presented by: Mike McDonald and Todd Kerpelman

Give us your feedback in the comments below and help shape the future of Firebase.

#FirebaseSummit event: Firebase Summit 2018; re_ty: Publish; product: Firebase - Cloud Functions, Firebase - Security Rules; fullname: Mike McDonald, Todd Kerpelman;

[joereem]

Listened to it at 2x speed. Was amazing.

[tedmcfadden]

Good stuff. Real gem there in tip #8 about using cloud functions for security and to transform "simple" client documents that describe a desired action

[mysomervda]

Great presentation, covers a lot in 25 minutes. BTW: Code at 12:02 may let through the case when user updates status but also would then allow updates to other properties on the document (That we probably don't want to happen) ? I think it should also be checking other properties of the document are not being changed?

[belqisshida]

Is Cloud Firestore a good selection for a bank account? Can it be safe and reliable to save people's money which is a number to the Cloud Firestore? My concern is reliability and security. Any suggestions?

[shauryaaher]

Awesome, guys! Yes, Todd is cool and I like Mike too.

[Quetzalcoatl]

"Five" rules ^_^.
Great stuff, thou.

[tiagooliveira]

Is it safe to assume that my client code is safe if authentication is required to access Firebase Database?
If a user makes changes to my app the signature will also change and this will make it impossible for the user to log-in into my app using firebase am i right?

[guitark]

Can't hide the config on client side, it's client side, anybody can have that

[neryortez]

You should've said from the start to see the video on 0.75 speed
xD

[monstera]

But you don't say, how to secure decompiling app and hack my base( #0)

[MaheshKumar-lqxm]

Rules have become complicated than the actual app 😂