Incorrect Recommendation for Double Encryption in OWASP M5: Insecure Communication

[pinpinsec]

The OWASP Mobile Top 10 2023 documentation under M5-Insecure Communication states: "Apply a separate layer of encryption to any sensitive data before it is given to the SSL channel."
(If possible, apply a separate layer of encryption to any sensitive data before it is given to the SSL channel. In the event that future vulnerabilities are discovered in the SSL implementation, the encrypted data will provide a secondary defense against confidentiality violation.)

This advice could introduce security risks. Double encryption can prevent security appliances like WAFs from detecting malicious payloads. If an attacker modifies traffic, the secondary encryption layer might prevent proper inspection, allowing malicious traffic to reach the server undetected.

This suggestion contradicts the principle of effective traffic monitoring and inspection, particularly for mobile applications where WAFs are crucial in detecting manipulated traffic