Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I’ve been poking around in the Application Support folder of a popular app, trying to extract some chat logs. (By “popular”, I mean that most people reading this will have heard of it. I’m not sure if it’s a good idea to explicitly name them here.)

I was able to find my chat logs, but I also found data for somebody else (a friend who had once borrowed my device to send a few quick messages, but logged out afterwards). All of this data was stored in an unencrypted form, and it would be relatively trivial for me to extract what is potentially sensitive data.

I’ve begun writing a bug report to the developer in question, because this seems like a really bad thing to me. I can see the potential benefit: when a user logs back in, all of their data is waiting for them. But I think it’s a really bad thing to store this all in an unencrypted way, where somebody malicious could find it.

My question is this: am I being naive in thinking this? Is it actually a bad idea to store user data this way, or am I overly paranoid?

share|improve this question
3  
If the key is present in the client software, then what would prevent you from extracting it? Chat logs can be turned off and on, it is the responsibility of the user to keep them safe, not the program IMO. –  Lucas Kauffman Jun 16 '12 at 11:03

1 Answer 1

up vote 4 down vote accepted

Anytime you use a computer of unknown provenance, you are at risk. It could have a hardware keylogger, a rootkit, or sketchy SSL certificates, etc. You really have no idea. It's best to do your sensitive work on machines you trust -- in this case I should think your friend trusts you.

You actually asked two questions though: should an app remove OR encrypt local user data?

Let's start with encryption. Yes, an application should encrypt data if it is considered sensitive enough. I personally doubt that chat logs are sensitive enough, but if a program is storing credit card numbers or SSNs, then it would be reckless and irresponsible not to encrypt that information. If you believe your chat logs are truly sensitive, then you are probably the type of person that should be using whole disk encryption (WDE).

Of course, when implementing encryption, you run the risk of muffing it up. If you do manage sensitive information, please use a well-known framework rather than writing that code yourself. For example, on OS X, you can use Keychain Services to store credit card numbers and social security numbers.

Now let's consider removal. One of the growing niches in security is privacy, and we're seeing more and more now that it's not acceptable to capture information about a user without that user's permission, especially if the information capture isn't obviously required to perform whatever tasks the application is supposed to do.

In client-server applications, there have been some obvious examples of failures in this regard, such as Path uploading all of your contacts. However, even storing user data on the client side can be a major privacy breach, as seen when Apple accidentally stored GPS tracking data on user's phones. Another example of this is malware that targets bitcoin files.

In the first two cases, the central issue seems to be the unexpected and indefensible collection of information that users did not expect them to be collecting. In Path's case, they should have never collected that data in the first place. In Apple's case, they have a valid use case for recording recent GPS data, but a bug resulted in those GPS logs not being truncated properly. Apple should have been more up-front about why iOS collects that data, and they should have tested that feature more to make sure it worked right.

The bitcoin example is slightly different: in that instance, the user clearly expects that data to be saved, but does not expect that his/her data can be stolen so easily. In this case, the application managing that data should have encrypted it. It was reckless to design digital currency management software and not build encryption into the design of it.

Your question is actually very insightful. As an industry, we're still not 100% sure what the answers are to some of these questions regarding privacy and security. I believe that over time we will see more and more attention placed on the issue of encrypting or removing data collected about users.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.