Native App

From MgmtWiki
Jump to: navigation, search

Full Title or Meme

A digital Entity that is operating on a User Device, but is typically supplied by the Web Site or some Federation.

Context

  • When discussing the use of the internet by a user, what is really meant is the presence of the user's agent on an internet connection.
  • Typically the Native App will run on a User Device in the user's physical possession, but it is possible that the agent is running on a service in The Cloud.
  • The Native App may act like a browser and supply an HTTP user agent string, but it should not be considered to be a User Agent.
  • The Native App may act like a web server by registering Native App URI Handlers so that it will receive registered URLs entered into the browser.

Problems

  • Nearly any application running on a user's device is allowed to access the internet and claim that it represents the user. There is no built-in mechanism to test this assertion by an internet connected service. The internet was designed to connect computer systems, and that is all it can be relied upon to do.
  • Any Web Site that wishes to create a Persistent Identifier for a User will need to take responsibility for any necessary Assurance that the Native App has not been compromised by an attacker.
  • Most of the larger enterprises operating on The Web prefer to supply a Native App to the users device to improve the User Experience for that site.
  • To be sure that the User's intent is expressed by the Native App appears to be an insurmountable obstacle.

Solutions

  • Certification of the Native App please refer to page Native App Security.
  • The Native App should perform all Authentication of the user by way of a browser (User Agent) selected by the user and running on the user's device using a trusted Identifier or Attribute Provider.
  • Pre Oauth Entity Trust describes a means to represent third-party application endorsement for health care applications. POET’s goal is to help consumers distinguish between applications that have an endorsement versus applications that have no pedigree (i.e untrusted and could be malicious).

References

  1. Native App Security page in this wiki
  2. Native App Privacy page in this wiki
  3. Native App URI Handlers page in this wiki
  4. W3C page on web apps best practices as of (2010-12-10).
  5. IETF RFC 8252 OAuth 2.0 for Native Apps https://tools.ietf.org/html/bcp212#section-7.2
  6. Apple App Store Review Guidelines https://developer.apple.com/app-store/review/guidelines/