Tone down importance of MASVS-RESILIENCE - #771
Conversation
| ## Description | ||
|
|
||
| Running on a platform that has been tampered with can be very dangerous for apps, as this may disable certain security features, putting the data of the app at risk. Trusting the platform is essential for many of the MASVS controls relying on the platform being secure (e.g. secure storage, biometrics, sandboxing, etc.). This control tries to validate that the OS has not been compromised and its security features can thus be trusted. | ||
| Running on a compromised platform that can be very dangerous for the user, as this may disable certain security features, putting the data of the user at risk. A compromised platform can disable certain security features (e.g. secure storage, biometrics, sandboxing, etc.). This control tries to validate that the OS has not been compromised and its security features can thus be trusted. |
There was a problem hiding this comment.
putting the data of the user at risk this is one part. Compromised platforms put the intellectual property of the owner of the app (e.g. API keys) equally at risk.
This change also removes the principle of chain of trust which is a cornerstone in app security.
I see this change as a decrease of quality in our document.
There was a problem hiding this comment.
@Diolor if you don't want me to possibly get my hands on an API key, don't store it on my machine. Anything else is anti ownership and not compatible with user freedom.
There was a problem hiding this comment.
if you don't want me to possibly get my hands on an API key, don't store it on my machine correct. And Resilience controls is the only (currently proven scientific) way a party can trust "your" machine when that is deemed necessary.
There was a problem hiding this comment.
putting the data of the user at risk this is one part. Compromised platforms put the intellectual property of the owner of the app (e.g. API keys) equally at risk.
The API key serves the purpose of giving access to the API for the user. At that point it is not your property, you have made it for the user. If you believe it is being misused, revoke it.
This change also removes the principle of chain of trust which is a cornerstone in app security.
It is indeed a cornerstone of security. Another cornerstone is trust itself, and trust is mutual, trust cannot be enforced. Trust is rooted in the user, more precisely the device owner. Otherwise, why are you providing services to them?
There was a problem hiding this comment.
@randomstuff just wanted to mention, there is so much activity in these issues I can hardly participate in the discussion. I just opened these notifications by kind of a mistake, and I could not stand to not give my correction above. It is infuriating that the industry "best prectices" condone and even advise taking away user device ownership.
There was a problem hiding this comment.
And Resilience controls is the only (currently proven scientific) way a party can trust "your" machine when that is deemed necessary.
"your" machine
are you directly debating ownership here? are you arguing, our devices are yours and your businesses to control? how should we interpret these quote marks?
| Running on a platform that has been tampered with can be very dangerous for apps, as this may disable certain security features, putting the data of the app at risk. Trusting the platform is essential for many of the MASVS controls relying on the platform being secure (e.g. secure storage, biometrics, sandboxing, etc.). This control tries to validate that the OS has not been compromised and its security features can thus be trusted. | ||
| Running on a compromised platform that can be very dangerous for the user, as this may disable certain security features, putting the data of the user at risk. A compromised platform can disable certain security features (e.g. secure storage, biometrics, sandboxing, etc.). This control tries to validate that the OS has not been compromised and its security features can thus be trusted. | ||
|
|
||
| On the other hand, these controls are arguably the responsibility of the platforms. Moreover, The user may have legitimate reasons to run the application on an alternative platform, which make actually be more secure than the blessed platform and it may not be possible for the application to make the distinction between a compromised platform and an alternative platform chosen by the user. Refusing to execute on alternative platforms can therefore have a negative impact on security, sovereignty and reinforce anti-competitive practices by platform vendors. Therefore, while it may be reasonable to warn the user if the application has reasons to believe that some security features may be disabled or that the platform may be compromised, locking the user out of the application is usually not legitimate. |
There was a problem hiding this comment.
The trade is clear to me: chain of trust vs. platform sovereignty.
The scope of MAS project on this tradeof is something different.
However I tend to agree that this is a limitation of Resilience controls which should be mentioned. To be precise: only from the perspective of the user. From the perspective of the company if a platform cannot be trusted, the device and app functionality can also not be trusted.
There was a problem hiding this comment.
Most businesses have no business in determining to trust or not certain platforms, or user devices. They should keep their secrets to themselves. Do they want to provide access to users, or not? If the users are your enemy, dont market to them.
4 participants
This is a draft PR addressing discussion #757 as per #757 (comment)