Dionysis Lorentzos
Mobile Engineering Manager · CISSP · OWASP MAS Lead Author
Dio is an Engineering Manager on the Mobile team at Enpal, a Berlin-based solar energy company, where he leads Flutter, Android, and iOS development. His focus spans mobile infrastructure, customer data, and security. A practitioner turned leader, Dio combines native mobile experience with a track record in engineering management.
He holds a CISSP certification and is a lead author of the OWASP Mobile Application Security (MAS) project. Previously EM Mobile at ShareNow, he also maintains open source Android libraries with over 6,000 combined GitHub stars.
You Are Already Compromised: Why Attestation Is the Foundation of Mobile Security
Do you have hardcoded API keys in your app? You're already compromised - but not for the reason you think.
Your app can have certificate pinning, encrypted storage, biometric authentication, and runtime integrity checks - and still be completely compromised. Why? Because all of these controls share a silent assumption: that the environment running your app can be trusted. Without attestation, that assumption is never verified.
This talk explores device and app attestation on Android and iOS – what it is, how it works under the hood, and why it forms the root of a secure chain of trust. We'll look at how attackers bypass security controls when attestation is absent or misconfigured, and how to implement it correctly using platform-native mechanisms (Android Key Attestation, Play Integrity API, Apple DeviceCheck and App Attest). It's the one that makes all the others meaningful — presented by the OWASP MAS Author behind the attestation Best Practices, Tests, Demos, and Knowledge base.