Nowadays we are putting a lot of trust in mobile apps in order to survive in a globalized society. We are even under a kind of peer pressure which madly drives us to use these new applications. One may even say that everyone does, so why shouldn't I! But what if the backend server leaks/discloses our confidential data (e.g. social security number, credentials, etc) and a malicious person takes advantage of it (which might even threaten our safety).

I'm wondering if there has been any research with respect to the safety and security issues of mobile apps and whether a technical solution exists. Can a third party guarantee the safety/security issues?

  • So could you decide if the main question is the one that asks for a product recommendation (research), is purely subjective (how can I trust?), or is too broad (can a third party guarantee something?). Because it's hard to choose the reason for closure... – techraf Jul 21 '16 at 6:58
  • Ok let me give you an example. Let say Pokemon Go. In top of your google account, You have to give a lot of information through your mobile sensors, such as location, camera, sound, etc, which can be used, for example, to reconstruct the 3D model of where you are and etc. I'm looking for a currently available technical solution. I'm looking for thoughts. The third party was an example that crossed my mind. – Jolfaei Jul 21 '16 at 7:05
  • Now it's perfectly clear it should be flagged as too broad. Thank you. – techraf Jul 21 '16 at 7:06
  • I'm soliciting thoughts and wisdom. You may help to revise the question rather than killing it. – Jolfaei Jul 21 '16 at 7:08
  • 2
    StackExchange is about facts and knowledge, not thoughts and wisdom. – techraf Jul 21 '16 at 7:11
  • A relevant base of the level of trust of an app can be how much of your phone does it needs to access. Some apps require very little access and can do a lot of useful stuff. Some require only needed access, like a flashlight app needing camera access, but many also abuse wanting access to way more than they actually need. It would be illogical for a flashlight to access a lot more functions in the phone except the camera itself.

  • Another relevant thing is how much spam does it produce. Generally, this is a reason I don't personally trust many apps. They keep spawning pop-ups. Some keep spawning them even if they are paid versions; they just spam something different (like other info about other apps from the same company).

  • There is no third party guaranty for safety or privacy. If an app gets access, it can do whatever it wants with that access and it's way harder to trace that compared to a PC system, unless it is controlled strictly by another app, which usually is not the case (I find the 3rd party control apps are not advanced enough yet).

  • The solution for some security is an app that can limit the control of other apps. While most of them can just pass-lock access to apps, some are more advanced and require root privileges. In the case of root access, such an app should be mandatory, since on root mode the other apps can take over phone functions much more deeply and easier. This is the 3rd party way to be a little safer, but not close enough to what I would like at this point.

  • There is then also the problem of commodity. The more advanced an app-control app is, the more inconvenient it will be to use. You will have to find a good balance between the security part and the convenience part.

  • My approach to this was to install a bunch of apps on a test device, use them for a while just to see how things go, then keep only the ones that proved to be safe, proved to be reliable and did not ad-spam me. This is valid also for the control app.

| improve this answer | |
  • Thank you for sharing your thoughts (+1). Much appreciated. I wish some one from crypto background could also shed some lights in terms of trust, security verification and homorphism (if applicable here). – Jolfaei Jul 21 '16 at 9:32
  • You can write or get an app that monitors enough so you are able to determine what the other ones are doing, but this is valid as long as there are no encryption systems involved in the app itself or in its communications. Something like android apktool or similar can decode resources to nearly original form and rebuild them (it is a tool for reengineering 3rd party closed, binary Android apps) it makes possible to debug code step by step. Something like this is mandatory if you really need to dig into things. – Overmind Jul 21 '16 at 11:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.