https://hostspica.com/research Engineering write-ups, R&D notes and guides on how HostSpica apps are built and secured. en https://hostspica.com/research/check-android-app-has-no-internet-permission https://hostspica.com/research/check-android-app-has-no-internet-permission An Android app needs the INTERNET permission to reach the network. Here is how to confirm an app does not declare it, what that does and does not guarantee, and what we found in HostSpica Identity 1.0.0. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/how-totp-works-and-how-hostspica-authenticator-implements-it https://hostspica.com/research/how-totp-works-and-how-hostspica-authenticator-implements-it A step-by-step walk through RFC 6238 time-based one-time passwords, the exact algorithm HostSpica Authenticator runs on your phone, the test vectors you can check it against, and where TOTP stops protecting you. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/inside-google-authenticator-export-qr-otpauth-migration https://hostspica.com/research/inside-google-authenticator-export-qr-otpauth-migration What is inside the otpauth-migration QR code that Google Authenticator shows when you export accounts, how HostSpica Authenticator reads and writes it, and why exports are split into pages of at most 10 accounts. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/how-hostspica-backups-are-encrypted-formats-and-limits https://hostspica.com/research/how-hostspica-backups-are-encrypted-formats-and-limits The exact format of HostSpica backup files, how your password becomes an encryption key (PBKDF2 with 600,000 rounds, then AES-256-GCM), what happens on a wrong password or a tampered file, and the limits you should plan around. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/where-every-hostspica-secret-lives-keystore-key-hierarchy https://hostspica.com/research/where-every-hostspica-secret-lives-keystore-key-hierarchy Every key HostSpica Authenticator, Passkey and Identity use, where it is stored, what it protects, what is not encrypted, and what Keystore protection does and does not stop. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/passkeys-from-first-principles https://hostspica.com/research/passkeys-from-first-principles A plain explanation of how passkeys and WebAuthn work: the key pair, the challenge, why a fake site cannot use your passkey, the difference between synced and device-bound passkeys, and what you lose if you lose the phone. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/how-an-android-passkey-provider-works-credential-manager https://hostspica.com/research/how-an-android-passkey-provider-works-credential-manager What happens inside HostSpica Passkey when a site asks to create or use a passkey on Android: the Credential Manager hand-offs, the authenticator data we build, Android key attestation, the bugs we hit, and what we do not support yet. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/how-android-autofill-and-hostspica-vault-protect-each-fill https://hostspica.com/research/how-android-autofill-and-hostspica-vault-protect-each-fill How an Android Autofill service sees a login form, how HostSpica Vault matches entries to sites, why the password is released only after a biometric check, and the limits of Autofill, including a lookalike-domain flaw we found and fixed before release. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar) https://hostspica.com/research/threat-model-local-only-authenticator-passkeys-and-vault https://hostspica.com/research/threat-model-local-only-authenticator-passkeys-and-vault A plain threat model for HostSpica Authenticator, Passkey and Identity: who might attack, what each protection stops, what it does not, and which risks remain. Written by us, not independently audited. Sat, 03 Oct 2026 03:30:00 GMT contact@hostspica.com (Rohan Kumar)