Permissions

This section describes the required permissions and configuration settings for iOS and Android signal collection.

Risk Management SDK permissions

The following table provides the permissions required for signals under each signal group. If the necessary permissions are not provided, there is no signal collection in the Risk Management SDK. Hence, the signal is not considered for risk assessment at the Risk Engine back end.

Permission required for each signal

Permissions required for ThreatMetrix

The following table provides the permissions required for ThreatMetrix profiling.

iOS certificate pinning for release configuration

You can configure the Risk Management SDK back end and application server URLs in the ATS configuration of Info.plist.

The Risk Management SDK established its HTTPS connection over TLS with the Risk Engine back end to get the visitID. To protect from man-in-the-middle attacks, it rejects hostname-mismatch and self-signed certificates, and accepts only root CA trusted certificates. In addition, the Risk Management SDK also uses strong cipher suites.

ATS is part of the application's configuration, so the following settings need to be added to the application's plist file via Key > App Transport Security Settings.

1. In the application’s Info.plist file, add a dictionary with App Transport Security Settings.

   

2. In the Application Transport Security Settings (ATS), configure the parameters for Exception Domains based on the GAH back-end URL.

   

Recommendations for the host application

• NSAllowArbitaryLoads key is set to NO by default. Setting the key to YES indicates that it will be opted out of ATS and from its associated security benefits.

• NSExceptionDomains dictionary sets name specific domains for which exceptions need to be set. Currently no exceptions are required, adding domain names is required only for certificate pinning.