CyberCertPrepMobile Security FundamentalsApp ComponentsEASYFree question
What is the security difference between an Android 'explicit Intent' and an 'implicit Intent' for starting an internal Activity?
- A.A. An explicit Intent specifies the exact target component (package + class name), ensuring only that component handles the request; an implicit Intent is resolved by the system against all matching components on the device, potentially routing to a malicious app that registered a higher-priority IntentFilter
- B.B. Implicit Intents are encrypted by the system while explicit Intents are sent in plaintext to the target component
- C.C. Explicit Intents require the EXPLICIT_INTENT permission, which only system apps hold
- D.D. Implicit Intents are safer because they use Android's intent resolution algorithm which validates sender signatures
Why A is correct
Explicit Intents identify the target by full class name, making them immune to interception by third-party apps. Implicit Intents (e.g., ACTION_VIEW with a URI) go through the system intent resolver, which may offer or automatically route to any matching installed app. For internal navigation between an app's own components, explicit Intents are mandatory best practice. Android's intent resolution does not validate sender signatures (D).
Know someone studying for Mobile Security Fundamentals? Send them this one.