-
-
Notifications
You must be signed in to change notification settings - Fork 2.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[MSTG-STORAGE-12] Add Privacy Labels and Rework Privacy Chapter #1988
Conversation
- [Enable the App Privacy Report](https://developer.apple.com/documentation/network/privacy_management/inspecting_app_activity_data) from the iOS settings (iOS 15.2 and higher) to monitor app activity data. After using the app extensively, you can save the report as JSON file containing a collection of dictionaries of different types. Parse for the `type: "access"` to inspect all data access by category (camera, contacts, etc.) and the `type: "networkActivity"` to examine all network accesses. | ||
|
||
|
||
These are some examples of common violations that you should report: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
How would this work in real-life for the user and for us during verification?
Would we verify that a one-time pop-up is explaining this (which will be anyway coming when accessing camera, contacts etc due to approving the permission), so the additional information is needed? Or would we simply verify the nutrition / data safety labels?
Where would it be defined that something is sensitive data, like An app that records a user’s screen and doesn't treat this data as personal or sensitive data subject to this policy.
This is defined by the developer in the app? What would be the testing process, the tester would run app activity https://developer.apple.com/documentation/network/privacy_management/inspecting_app_activity_data
and then we check it against the privacy policy?
I think it's quite a few options we are listing above, so we might want to clarify a bit further and give some more guidance, otherwise it might be a bit overwhelming what to do now exactly.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Since we're testing MSTG-STORAGE-12:
The app educates the user about the types of personally identifiable information processed, as well as security best practices the user should follow in using the app.
I think the testing strategy for now should be:
- look at if and what the app declares it collects/shares (in the App Store iOS Privacy Details and in Google Play Safety Section).
- check if the app is at least doing everything it could be doing to inform the user:
- using prominent in-app disclosure of data access, collection, use, and sharing.
- using the "App Tracking Transparency Framework" / "Data Access Auditing".
I'm going to reflect this on this sub-section (now there's more info than required). We should address that but as part of other test cases / requirements.
Co-authored-by: Sven <sven@bsddaemon.org>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Co-authored-by: Corie Lynch <Lynchc17@gmail.com>
Thanks for your nice review and thoughts @corielynch, this really helps a lot! I went through all the suggestions. You may approve now if everything is fine. If not just let me know or keep sending more comments 😊. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Few comments we should discuss further!
|
||
As a new requirement on both platforms, it's vital that these labels are accurate in order to provide user assurance and mitigate developer abuse. | ||
|
||
### Common Violations that Can Be Addressed with the New Approach |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
How shall the Pentester verify "An app that records a user’s screen and doesn't treat this data as personal or sensitive data that is subject to this policy." and also the others listed? Does this mean the nutrition / data safety label is missing?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We could make this maybe part of the test case below, or otherwise reference to it to make it clear how to test.
1. Search for the app in the corresponding app marketplace (e.g. Google Play, App Store). | ||
2. Go to the section ["Privacy Details"](https://developer.apple.com/app-store/app-privacy-details/) (App Store) or ["Safety Section"](https://android-developers.googleblog.com/2021/05/new-safety-section-in-google-play-will.html) (Google Play). | ||
3. Verify if there's any infomation available at all. | ||
4. Compare the information available against the actual context of the app. Does everything make sense? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That seems to be quite a big ask. Should this really be the job a penetration tester to verify? Or should the pentester just record and verify the app inspection and make it part of the deliverable?
A pentester might not want to give assurance for privacy violations in such a detail as this could become quite time consuming and should focus on vulnerabilities (including raising suspicious app permissions) in the app and endpoint.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'll modify the conclusion/assessment paragraph below to reflect that for this test, verifying this is actually enough. After that I'll add the "app activity monitoring/exported Privacy Report" below as "Dynamic Analysis", being an optional step providing evidence.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you @cpholguera. This is a great summary for privacy in mobile apps and how to verify it
Closes #1967 and:
I proposed a more adequate title, since the file was named 0x04i-Testing-user-interaction.md and the chapter titled “Testing User Education”. I think that “Testing User Privacy Protection” reflects better the topic addressed here, being user education part of it.
I also included a disclaimer, an overview where I tried to present the topic by parts and introduce some concepts as well as the new stuff (Google and Apple labels) and of course the Test Cases.
There’s one Test Case with 2 tests inside. I’m trying here to shape it to the new approach we’re taking with the requirement.
In the future, once we decided how we want to shape the MSTG we could maybe introduce test case IDs. There will be one file/folder per MASVS-ID containing several tests.
This way we have concrete atomic tests that we can parse. (similar to the Test Case column in the new spreadsheets; that column could be generated automatically next time 😉 )