Web View - Revision history

Tom: /* References */

2022-04-08T17:01:51Z

‎References

Tom: /* Solutions */

2019-05-25T01:27:56Z

‎Solutions

Tom: /* Organizational Support */

2019-05-09T00:57:56Z

‎Organizational Support

Tom: /* Problems */

2019-05-07T20:36:39Z

‎Problems

Tom: /* Problems */

2019-05-07T20:36:14Z

‎Problems

Tom: /* Solutions */

2019-05-07T20:31:10Z

‎Solutions

Tom: /* Other References */

2019-05-07T20:27:22Z

‎Other References

Tom: /* Other References */

2019-05-07T20:26:21Z

‎Other References

Tom: Created page with "==Full Title and Meme== A display of information from a Web Site by an application that is installed on a user's computing device with full power to act as the user. ==Co..."

2019-05-07T20:24:59Z

Created page with "==Full Title and Meme== A display of information from a Web Site by an application that is installed on a user's computing device with full power to act as the user. ==Co..."

New page

==Full Title and Meme==
A display of information from a [[Web Site]] by an application that is installed on a user's computing device with full power to act as the user.

==Context==
* The first of the [[Laws of Security]] tell us that when an attacker gets to run their code on your computer, it is no longer just your computer any longer.
* The [[Native App]] that is displaying the [[Web View]] is operating on the user's device with all of the privileges that the user enabled when the app was loaded.

==Problems==
*In [[Open Banking]] it is proposed that a payment initiator and a bank can both have [[Native App]]s running where the payment initiator app asks the banking app on the same device for permission to remove money from the user's account.
* The article [https://www.wired.com/story/iphone-touch-id-scam-apps/ Watch Out for a Clever Touch ID Scam Hitting the App Store] shows how unscrupulous apps can fool the user in to granting access to their bank accounts.
* A [[Web View]] is a display of information from a [[Web Site]]. There is no trustworthy indication that the [[Native App]] has correctly displayed the information that it obtained from the [[Web Site]].

==Solutions==
* The [[Native App]] exposes its name and the web site that backs it in a manner that allows the user to make a meaningful trust decision.
** Android play store requires<ref name='android'>''Handling Android App Links.'' https://developer.android.com/training/app-links/</ref> any app that uses a brand name service to be securely bound to a [[URL]] that properly exposes that brand.
** Apple has not released any plans to improve app naming security as of 2018-09-21.
* Joint use [[Native App]]s are provide to some industries for all to use. It makes the trust decision by the user much more difficult.
* [https://www.owasp.org/index.php/SameSite Same Site] was designed to help, but [https://outlook.live.com/mail/inbox/id/AQQkADAwATExAGMzNy1iY2JmLWIwYmYtMDACLTAwCgAQAHD5YNrixl9FqyVrfekhw50%3D as of (2018-09-21) is not consistently applied].
===Organizational Support===
* Rules for apps installed on Apple devices are (not clear)
* Rules for apps installed on Android devices <ref name='android'></ref>
* Rules for apps installed on Windows devices are of two types, but it is not clear how the user could possibly distinguish, so the concept has not been helpful.
*[https://github.com/TransparentHealth/poet Pre Oauth Entity Trust] describes a means to represent third-party application endorsement for health care applications. POET’s goal is to help consumers distinguish between applications that have an endorsement versus applications that have no pedigree (i.e untrusted and could be malicious).
* Android App list of [[Data Category|Data Categories]] that require [[User Consent]]. https://support.google.com/googleplay/answer/6270602?hl=en
* Apple iPhone App Requesting Permission: https://developer.apple.com/design/human-interface-guidelines/ios/app-architecture/requesting-permission/
* Apple iPhone app Requesting Authorization to use System Features: https://developer.apple.com/documentation/uikit/core_app/protecting_the_user_s_privacy
* Apple CKContainer manages all attempts to access user data on the device or in iCloud. https://developer.apple.com/documentation/cloudkit/ckcontainer
* Windows (UWP) settings are on all Windows 10 computer, but do not seem to be shown anywhere on the web. Just navigate start -> settings -> privacy -> app settings.
==References==
<references />

===Other References===
* [https://www.owasp.org/index.php/Main_Page The Open Web Application Security Project (OWASP)] is a 501(c)(3) worldwide not-for-profit charitable organization focused on improving the security of web site software.
* [https://www.nationalisacs.org/ ISAC]s are member-driven organizations, delivering all-hazards threat and mitigation information to asset owners and operators.
* [[Native App]] wiki page.
* [[Native App Privacy]] wiki page.

[[Category:Security]]
[[Category:Identifier]]

← Older revision		Revision as of 17:01, 8 April 2022
Line 42:		Line 42:
	[[Category:Security]]		[[Category:Security]]
	[[Category:Identifier]]		[[Category:Identifier]]
		+	[[Category: Web]]

@@ Line 10: / Line 10: @@
 * The article [https://www.wired.com/story/iphone-touch-id-scam-apps/ Watch Out for a Clever Touch ID Scam Hitting the App Store] shows how unscrupulous apps can fool the user in to granting access to their bank accounts.
 * A [[Web View]] is a display of information from a [[Web Site]]. There is no trustworthy indication that the [[Native App]] has correctly displayed the information that it obtained from the [[Web Site]].
-* Any script running inside of a [[Web View]] is operating with the full permissions of the user. There is no sandbox as this is with a trustworthy web browser.
+* Any script running inside of a [[Web View]] is operating with the full permissions of the user. There is no sandbox as there is with a trustworthy web browser.
 * There is no means for the user's device to indicate the trustworthiness of any running app.

@@ Line 10: / Line 10: @@
 * The article [https://www.wired.com/story/iphone-touch-id-scam-apps/ Watch Out for a Clever Touch ID Scam Hitting the App Store] shows how unscrupulous apps can fool the user in to granting access to their bank accounts.
 * A [[Web View]] is a display of information from a [[Web Site]]. There is no trustworthy indication that the [[Native App]] has correctly displayed the information that it obtained from the [[Web Site]].
+* Any script running inside of a [[Web View]] is operating with the full permissions of the user. There is no sandbox as this is with a trustworthy web browser.
 * There is no means for the user's device to indicate the trustworthiness of any running app.

← Older revision		Revision as of 20:27, 7 May 2019
Line 35:		Line 35:


		+	[[Category:Glossary]]
	[[Category:Security]]		[[Category:Security]]
	[[Category:Identifier]]		[[Category:Identifier]]

@@ Line 15: / Line 15: @@
 ==Solutions==
 * The [[Native App]] exposes its name and the [[Web Platform Identifier]] of the web site that backs it so that the user can make a meaningful trust decision.
-** Android play store requires<ref name='android'>''Handling Android App Links.'' https://developer.android.com/training/app-links/</ref> any app that uses a brand name service to be securely bound to a [[URL]] that properly exposes that brand.
+** Android play store requires<ref name='android'>''Handling Android App Links.'' https://developer.android.com/training/app-links/</ref> any app that uses a [[Brand]] name service to be securely bound to a [[URL]] that properly exposes that brand.
 ** Apple has not released any plans to improve app naming security as of 2018-09-21.
 * Joint use [[Native App]]s are provide to some industries for all to use. It makes the trust decision by the user much more difficult.

@@ Line 24: / Line 24: @@
 * Rules for apps installed on Windows devices are of two types, but it is not clear how the user could possibly distinguish, so the concept has not been helpful.
 *[https://github.com/TransparentHealth/poet Pre Oauth Entity Trust] describes a means to represent third-party application endorsement for health care applications. POET’s goal is to help consumers distinguish between applications that have an endorsement versus applications that have no pedigree (i.e untrusted and could be malicious).
 * Android App list of [[Data Category|Data Categories]] that require [[User Consent]]. https://support.google.com/googleplay/answer/6270602?hl=en
 * Apple iPhone App Requesting Permission: https://developer.apple.com/design/human-interface-guidelines/ios/app-architecture/requesting-permission/

@@ Line 31: / Line 31: @@
 ===Other References===
 * [https://www.owasp.org/index.php/Main_Page The Open Web Application Security Project (OWASP)] is a 501(c)(3) worldwide not-for-profit charitable organization focused on improving the security of web site software.
-* [https://www.nationalisacs.org/ ISAC]s are member-driven organizations, delivering all-hazards threat and mitigation information to asset owners and operators.
 [[Category:Security]]
 [[Category:Identifier]]