Difference between revisions of "Apps on User Devices"

Revision as of 10:23, 19 October 2020

Full Title or Meme

This design pattern focuses on ways to get computing power and security into the devices that are in the user's hands.

Context

• A world where the computing device in the user's hand is more powerful than supercomputers of the past generation.

Use Case

• Preconditions: The user is given the legal right to acquire their own health records with the 21st Center Cures Act and regulations.
• Regulation: Requires that Electronic Health Records (EHR) for the user may (subject to limitations) be downloaded into user apps from certified developers.
• Use Case: This is one approach to meeting this regulation.
• Specifications: The current state is that the CARIN alliance has published a Code of Conduct for user apps.
• Service Assessment Criteria: Proposed work item pending funding.
• Certification document for Apps: Draft now available at https://kantarainitiative.org/confluence/display/WT/Draft+Recommendations
• Proof of Presence of user and app: Proposed work item pending funding.
• Trust Registry that can verify app certification and presence: Proposed work item pending funding.

App Categories

As of 2020-10 there are two categories of app that are proposed for user by users:

Native Apps

• These have been available at the dawn of the smart phone. The apps are constructed in an interpreted language (like java or .NET) on the "native" (really interpreted) environment of the device.

Web Apps

• Also known as Progressive Web Apps, these are being aggressively advance by the browser vendors in the blink (chromium + webkit) environment.

Android example courtesy of James Manger:

In the use case, itsyourweb.org provides wallet software as a progressive web app (PWA). Presumably the PWA asks the user's browser to generate a key-pair; hopefully hardware-backed; perhaps requiring the user's device-unlock gesture for each operation with the private key; and maybe with an attestation (chaining back to the O/S vendor and/or device vendor) that the key has these protections. The PWA will use the private key to sign SIOP responses.

A user with such a wallet can only use it at RP that explicitly supports this specific wallet vendor; ie an RP that lists itsyourweb.org alongside, say, Facebook & Google as supported OPs in a NASCAR-style list of logos. In the example, Air Canada (the RP) shows a QR code specific to itsyourweb.org (not any other SIOP).

An RP doesn't get any assurance that a user is running the true itsyourweb.org wallet. The user could have installed their own root CA and their own DNS settings pointing itsyourweb.org to their own site. But, under the assumption that a user is running a "normal" browser on a "normal" O/S, the RP can assume the itsyourweb.org wallet is running, with all the protections and consent screens that itsyourweb.org is trusted to implement. That may be sufficient for an RP to show a duty-of-care towards users by only supporting quality wallets.

Perhaps in future attestations from the O/S vendor about the state & identity of a PWA will be possible, much like an Android SafetyNet attestation from Google gives some assurance about a mobile app.

References