Mobile Security–Storing & transmitting data

The recent controversy over the use of user contact lists by the developers of Path for iOS has caused an uproar in the mobile community. Here’s how the problem came about-

A developer was hoping to create a Path app for Mac OS and sniffed the data traffic to see how the app handled user data. It turned out that the app would take a user’s contact list and store it on the developer servers with no warning at all when the ‘Find friends’ feature was chosen. There was no specific encryption used, apart from SSL transmission which is adequate, and the man who discovered the problem then found his details stored in a simple .plist file.

As you can imagine, first thoughts are that this just isn’t right. Your contact list is not yours- you are storing details of other people and have responsibility for holding their information. When it is taken by a developer without your permission and then stored without your knowledge, it opens up all sorts of problems. Spam could be one issue, a dodgy developer could use your data for unscrupulous purposes and even a developer who does not want to use your information could pose a threat by being hacked into. The problem is not, however, that the developer may choose to do something with your data, but that it is held by them in the first place.

As it turns out, the behaviour of the Path app is completely normal in iOS and other apps are now starting to show warning messages that contact data may be stored. This applies to calendar data and your media library as well so you have potentially allowed your data to be stored by a number of developers, without your prior knowledge, over the past few years.

All of the above is worrying and can be considered to be an oversight by Apple, but there is a classic example of an OS that dealt with this problem in an opposite, but still wrong way.

Windows Vista popped up so many warning messages that they became invisible to the user. Over and over again they would suddenly appear on your screen in exactly the same place and the average user quickly reached the point where they knew the ‘Yes’ icon placement instinctively and hit it without thinking. In short, the overuse of warnings in Windows Vista made the experience disjointed and frustrating while eventually losing most of the security thanks to user annoyance. It just didn’t work.

Now, Android has come in for lots of criticism for malware and dodgy apps in the Android Market, but it may have the best solution of all. A dialogue pops up before you install the app and tells you what permissions the app requires. You should ALWAYS read these and if you are happy, you can then install it. Simple checks like asking yourself why a game needs access to your calendar and email make sense and if you are unsure, find another app.

Once installed, you need not worry about any future warning messages and can use the app knowing that it should not be able to access anything you have not accepted. This is not a 100% guarantee because that is simply not possible, but it appears to me that the Android method offers the most convenient balance between protection and ease of use for the customer. As it stands, the Apple method veers too far towards user experience and other methods are probably too prohibitive. In a world where so much of our information is now online, it may seem foolish to try to control our personal data in apps, but everything you do to ensure your personal data, and that of people who trust you, is secure can only be a good thing.

Update (thanks to Stephen for the tip):

Windows Phone has a similar feature, where apps can only access the parts of the platform it specifically requests. Before installing an app, you check this list to see if you expect and are happy for an app to access this information. When in the Marketplace, scroll to the bottom of the app description page and read the “Requires access to:” section before pressing Install. For an explanation of all the terms, check out http://www.microsoft.com/windowsphone/en-GB/howto/wp7/apps/download-apps-and-games-faq.aspx