6 ms·
A New Standard for Mobile App Security
- georgiecasey 6y agoWe don't need a security standard for apps from bluechip companies, we need better vetting of apps uploaded by nobodies to the app stores. And the Chrome plugin store while we're at it. I always thought Google should have a score system for Android developer accounts. You need to earn trust to have access to sensitive Android APIs.
- anaerobicover 6y agoWhat's your desired process for earning trust?
- georgiecasey 6y agoNew Google accounts start off with little trust. New apps start off with little trust. Established apps should have good trust along with Playstore verified developers. Android is destroying a lot of great file manager apps with the new scoped storage. These are great apps that have been in the store for 5 years plus. Surely these can be trusted. Of course, there'll be ways around this but it would stop a lot of dodgy apps. Of course, this is a lot harder as it sounds as you'd need all Android apps that want access to sensitive APIs to interact with the Playstore API. But it's better than Android just imposing systemwide security changes that break a load of apps.
- neolog 6y agoWhat if you want to make an app that doesn't work without a trust feature? Can you sell your trusted account?
- userbinator 6y agoI wouldn't be surprised at all if this turns out to be a way of locking out users and destroying right-to-repair/modify... all in the name of "security".
- wepple 6y agoWhat is it that suggests that might be the case?
- eplanit 6y agoHistory.
- kristofferR 6y agohttps://developer.android.com/training/safetynet https://developer.android.com/training/safetynet When they say "security threats" they really mean "root access".
- notyourday 6y agoIt may spell "security threats" but it reads "user control"
- resfirestar 6y agoWhat? It's a self-certification checklist for apps (really the cloud services behind the apps, it only has one section about the app itself and one of the items is just "provide a privacy policy"). Nothing to do with the OS or devices. The document the post is about: https://static1.squarespace.com/static/5c6dbac1f8135a29c7fbb621/t/604aa3fa668a8e3b50630433/1615504379349/Mobile_Application_Profile.pdf https://static1.squarespace.com/static/5c6dbac1f8135a29c7fbb...
- userbinator 6y agoThe problem is that it mixed good recommendations along with user-hostile ones. I have no qualms about things like "Detect and throttle guessing attacks" and "Require authentication for remote services containing user data.", but then there's also... SE1.1 End of life notification policy is published SE1.2 Expiration Date is published Planned obolescence. AA4 Security Updates applied automatically, when product usage allows VS4 Anti-Rollback User-control and herding. "You want this feature we removed? Too bad, fuck you." SI113 Enforce x509 certificate pinning for primary services. You can't easily MITM and see what data it's exfiltrating.
- system16 6y ago> The Internet of Secure Things Alliance (ioXt) manages a security compliance assessment program for connected devices. ioXt has over 300 members across various industries, including Google, Amazon, Facebook, T-Mobile, Comcast, Zigbee Alliance, Z-Wave Alliance, Legrand, Resideo, Schneider Electric, and many others. Apple being noticeably absent from this list while Facebook is on it speaks volumes.
- ChrisMarshallNY 6y ago> Apple being noticeably absent from this list while Facebook is on it speaks volumes. My thoughts, exactly.
- danpalmer 6y agoThis is interesting to me because Apple pushes the security so hard for connected devices. My understanding of the early HomeKit tech was that it was in fact prohibitively secure, and most low end manufacturers were unable to meet the security bar at the price they were targeting. This could be a bad indication about Apple, but I think I'd end up interpreting this as a bad indication about ioXt. Big consortiums like this often end up creating a lowest common denominator, and Apple are known for not bowing to pressure to engage with things like this where they believe they can do better.
- er4hn 6y agoI think that is the parents point...
- danpalmer 6y agoYeah I wasn't sure which way it was leaning so thought I'd add some more details to the discussion.
- deleted 6y ago[deleted]
- ChrisRR 6y agoIt's more like Apple loves to push their own standard on products and then hide them behind NDAs The amount of hoops you had to jump through to make a MFi bluetooth device was insane.
- tessela 6y agoObligatory: https://xkcd.com/927/ https://xkcd.com/927/
- miniyarov 6y agoThe initiative called VPN Trust Initiative (https://vpntrust.net/ https://vpntrust.net/) inside the article has a broken Contact Us form. It doesn't work :/
- Saint_Genet 6y agoisn't this this just STIGs by another name?
- CrazyPyroLinux 6y ago"The ioXt Mobile Application Profile [...] leverages existing standards and principles set forth by OWASP MASVS" In a way DoD (STIGs), NIST, Mitre, SANS, OWASP are all different takes on the same general idea.
- pjmlp 6y agoI bet mandatory device updates isn't part of the list.
- codethief 6y agoIt actually is, see page 9: https://static1.squarespace.com/static/5c6dbac1f8135a29c7fbb621/t/604aa3fa668a8e3b50630433/1615504379349/Mobile_Application_Profile.pdf https://static1.squarespace.com/static/5c6dbac1f8135a29c7fbb...
- pjmlp 6y agoI stand corrected, lets see if Google goes beyond 3 + 1 on their devices.
- z77dj3kl 6y agoThe standard itself looks kind of good, honestly! Have a look at 4.2 (pg 9): https://static1.squarespace.com/static/5c6dbac1f8135a29c7fbb621/t/604aa3fa668a8e3b50630433/1615504379349/Mobile_Application_Profile.pdf https://static1.squarespace.com/static/5c6dbac1f8135a29c7fbb... I think tech as an industry has come quite a long way in the past few years of clarifying (and hopefully adopting) what security best practices is. This, OWASP, and other similar initiatives are good: you can have a rough checklist of what's required to have a roughly "secure" app, and what the common loopholes are. This is not easy stuff. I don't know what this means for the institutional/enterprise side, whether certification will be meaningless, etc. But the document itself seems relatively sensible to me!
- ThrowawayR2 6y agoTheir certification requirements do seem solid but the concerning thing about ioXt is that, if you look at the list of certified devices / apps, there's a grand total of 3 pages containing less than 50 entries. Given the large list of members, it seems odd to have so few issued certifications.
- NateLawson 6y agoThis is kind of a ridiculous announcement, but I appreciate what they're trying to do. I find it ironic that they're trying to improve security & privacy for app users, but then the first apps they certify are almost exclusively VPNs, which are some of the worst for user privacy. VPN vendors collect all kinds of data on their users and are sometimes even backed by intelligence agencies. Sure, use them to get around region restrictions for something uncontroversial, but don't send all your traffic through them and expect privacy. I also see that they didn't tackle the hardest part of mobile app security -- the backend services. Many apps scrape data from the device and then push it to the service, where it is logged (for how long?) and reused in who knows how many ways. The lack of transparency around backend processing is the real problem for app users. How many users have been had their data exposed by an open S3 bucket or database versus by a vulnerability in the app code itself?