6 ms·
Maybe this is a good time to think about what policy could help discourage these horrific practices (it sounds like their storage was unprotected) * App Store
by tonymet 1y ago
Maybe this is a good time to think about what policy could help discourage these horrific practices (it sounds like their storage was unprotected)
* App Store review requires a lightweight security audit / checklist on the backend protections.
* App Store CTF Kill Switch. Publisher has to share a private CTF token with Apple with a public name (e.g. /etc/apple-ctf-token ). The app store can automatically kill the app if the token is ever breached.
* Publisher is required to include their own sensitive records ( access to a high-value bank account) within their backend . Apple audits that these secrets are in the same storage as the consumer records.
- tonymet 1y ago* Mandate 3rd party auditing once an app reaches > 10k users * App publishing process includes signatures that the publisher must embed in their database. When those signatures end up on the dark web, App Store is notified and the App is revoked
- fn-mote 1y ago> * Mandate 3rd party auditing once an app exceeds 10k users You have a lot of interesting suggestions. I would love to see some kind of forced transparency. Too bad back-end code doesn’t run under any App/Play Store control, so it’s harder to force an (accurate) audit.
- tonymet 1y agothanks. Yeah I think there are a lot of ways to decouple App store from publisher and auditor . That way the publisher can retain autonomy / control , while still developing trust with the consumer. We could do better in our trade at encouraging best practices in this space. Every time there's a breach , the community shames the publisher . But the real shame is on us for not establishing better auditing protocols. Security best practices are just the start. You have to have transparent, ongoing auditing and pen-testing to sustain it.
- tonymet 1y agoalso i remember maybe Facebook trying to do this when they acquired Parse. For a while they were promoting developers host their backends on Parse / FB . The idea has merit. You have to relinquish some control to establish security. Look at App Store, Microsoft Store , MacOS App store -- they all sandbox and reduce API scope in order to improve security for consumers. I'm more on the side of autonomy and trust, but then we have reckless developers doing stuff like this, putting the whole industry on watch.
- idkfasayer 1y ago[dead]
- beeflet 1y agojust use your brain and don't upload your face and driver's license to a gossip website. when I was growing up, it was common knowledge that you shouldn't post your identity online outside of a professional setting. The onus is on users to protect themselves, not the OS. As long as the OS enables the users to do what they want, no security policy will totally protect the user from themselves.
- tonymet 1y agoThe app store is auditing & restricting functionality within the iPhone, but the backend protections are a wild west. "use your brain" is no substitute for security. This is a hacker forum. We think about how to protect apps. Even smart people have slipped up
- dvngnt_ 1y agoThis is becoming more unfeasible as it becomes required to access online services like reddit, nexusmods, verification on dating apps. Sending facial, and documentation data is becoming mandated by governments across the world.
- alecco 1y ago[flagged]
- nemomarx 1y agoDo you think it'll stop with those sites? You might need it for your banking app soon, or to browse LinkedIn, or etc.
- alecco 1y agoBanks already ID you in person (at least the ones with branches). And LinkedIn has been useless for years for most of my family and friends.
- bigfishrunning 1y ago
- gruez 1y ago>* App Store CTF Kill Switch. Publisher has to share a private CTF token with Apple with a public name (e.g. /etc/apple-ctf-token ). The app store can automatically kill the app if the token is ever breached. How do you enforce the token actually exists? Do app developers have to hire some auditing firm to attest all their infra actually have the token available? Seems expensive.
- tonymet 1y agoit could be made available just to apple servers via ACL or protected token. but no one else .
- gruez 1y agoThat still doesn't make sense. How does the ACL work? What prevents the usual shenanigans like cloaking to prevent legitimate detection from working? Moreover what secrets are you even trying to detect? The app API token?
- tonymet 1y ago[flagged]
- gruez 1y agoI can't be constructive when your proposal is too vague to know how it works, I'm forced to take pot shots at what I think it is, and you getting upset because I'm not "constructive". Thoroughly explain how your plan works beyond the two sentences in your original post, and I can be "constructive".
- tonymet 1y ago[flagged]
- tonymet 1y ago[flagged]
- tbrownaw 1y agoYes, pushing companies away from mobile apps and towards PWAs or even ordinary websites does sound like an excellent idea.
- tonymet 1y agoit could be an enhanced certification like "Enhanced SEcurity" or "End to End security" to allow gradual adoption.
- tbrownaw 1y agoSo like those EV certs that turn the address bar green.
- tonymet 1y agobetter, in that the app store has more weight and more leverage to establish more comprehensive auditing. The EV certs failed because general SSL identity is pretty weak. Consumers don't know how to use it to establish trust. There's no enforcement on how the names are used. for example, my county treasurer has me transfer thousands of dollars on a random domain name.
- benlivengood 1y agoIn this case it appears to be a public Firebase bucket; shutting down the app wouldn't help. Quite possibly access to Firebase was mediated through a backend service and Apple couldn't validate the security of the unknown bucket anyway.
- tonymet 1y agoI partially agree. At least the threat of app shutdown would be enough consequence for the publisher to take things seriously
- benlivengood 1y agoI think iOS and Android already holds the threat of app store removal over developers' heads. Presumably the risk/reward still favors risky practices.
- tonymet 1y agobut it's not contingent on backend violations, only frontend ones. I'm proposing decoupled ways for app store validation to audit backend security.
- tonymet 1y agoAlso about validating the backends, apple has the resources to provide a level of auditing over the common backends. S3, Firebase -- perhaps the top 5. It's easy to provide apple with limited access to query backend metadata and confirm common misconfigurations.
- dabockster 1y agoThe world is moving away from App Stores and walled gardens. Figure out other options.
- tonymet 1y agothat sounds preposterous . can you qualify that?
- bigfishrunning 1y agoLinux is up to 5% of the desktop. Gog and Itch.io are DRM-free, and are slowly gaining ground against Steam. Fediverse networks are slowly gaining ground against traditional social media. Signal is more popular then ever. There will always be lowest-common-denominator users, but there is clearly some demand for an alternative to the biggest 5 websites...
- tonymet 1y agoi see thanks for clarifying
- ohdeargodno 1y ago>There will always be lowest-common-denominator users, Interesting play, calling 95% of users "lowest-common-denominator". Those silly, blabbering morons that don't understand that they should be running Bazzite on their Framework laptops instead of using evil evil sofware. >there is clearly some demand for an alternative to the biggest 5 websites... This demand doesn't pay, and also happens to be some of the most demanding, entitled users you'll have ever seen.
- bigfishrunning 1y agoI wasn't intending to insult anyone, just to refer to most users as "people who don't want to think about the tools they use, and don't care about privacy". Which i think is true of most people. I never called anyone a moron, they just have different priorities.
- Rendello 1y ago> Publisher is required to include their own sensitive records within their backend. Now that's a creative solution! Every admin must have a table called `MY_PERSONAL_INFO` in their DB.
- tonymet 1y agowouldn't it be funny if the app store had to review it and make sure the personal info was sensitive and possibly humiliating enough . "sir your app has been denied because MY_PERSONAL_INFO table requires at least 3 d-pics"
- bawolff 1y agoMake company liable for damages when breached. If you want companies to care about security then you need to make it affect their bottom line. This wasn't the work of some super hacker. They literally just posted the info in public.
- tonymet 1y agoI agree, but relying on lawsuits is far too slow and costly . We can reduce the latency of discovery and resolution by adding software protocols.
- bawolff 1y agoHaving the threat of lawsuits is not really about the actual lawsuit, its about scaring people into being more careful. If you actually get to the lawsuit stage, the strategy has failed. > We can reduce the latency of discovery and resolution by adding software protocols. Can we? What does this even mean? [Edit: i guess you mean the things in your parent comment about requiring including some sort of canary token in the DB. I'm skeptical about that as it assumes certain db structure and is difficult to verify compliance. More importantly i don't really see how it would have stopped this specific situation. It seems like the leak was published to 4chan pretty immediately. More generally how do you discover if the token is leaked, in general? Its not like the hackers are going to self-report.]
- tonymet 1y agoThe signatures would appear in the drop . A primitive version would be file meta data or jfif. Even the images themselves or steganography could be used
- bawolff 1y agoI guess, but it seems a bit like a solution that only works for this specific dump - most db breaches don't have photos in them. My bigger concern though is how you translate that into discovering such breaches. Are you just googling for your token once a day? This breach was fairly public but lots of breaches are either sold or shared privately. By the time its public enough to show up in a google search usually everyone already knows the who and what of the breach. I think it would be unusual for the contents of the breach to be publicly shared without identifying where the contents came from.
- TZubiri 1y agoI like the ctf one, but it would probably be hidden way deeper than the rest of the info.
- tacker2000 1y agoMore power to app store reviewers? Please no. They already deny apps for random reasons and figuring out why is often a hair pulling experience.
- tonymet 1y agoi agree about the power concerns, but where would you assign the authority if not the app store?
- danparsonson 1y agoThis is the kind of thing government regulation is useful for, when it works.
- tonymet 1y agoIn practice they delegate certification to a legacy and expensive certification authority