1

Using react-native, we save the first name and last name in Redux, which is a non-encrypted database within the app.

I have been tasked to secure this data. Either encrypt these two fields or save them in the storage of the phone.

How risky is to have the first name and last name saved in clear. Is it a security risk?

  • Quantifying risk is subjective. To more directly answer your question, storing PII does expose you to "some" risk, as well as puts you in scope for CCPA, or other regulatory or contractual obligations. Storing it in cleartext may expose you to more risk. Collecting but not storing it exposes you to less risk. In any case the amount of risk this exposes your organization to, and the amount of risk your organization is willing to accept are questions that only your organization can answer. – John Deters Mar 8 at 17:24
  • 1
    1: If it on the users device there should be no problem considering that the same information is on the use's device in several places. 2: Many phones encrypt all data saved in non-volatile (flash) memory, this includes all iPhones and many Android phones. – zaph Mar 8 at 21:04
1

I have been tasked to secure this data. Either encrypt these two fields or save them in the storage of the phone.

Modern smartphones (Android, iOS) already encrypt their flash when a pin or passcode is set. Your app's storage should be isolated and cannot usually be read by other apps. Assuming your app doesn't ask your user for a master password, any additional encryption you add can just be defeated by reverse-engineering your app. If you could store a per-user encryption key on the server side then you could just store the name and pass on the server anyway, so that's a pointless approach.

How risky is to have the first name and last name saved in clear. Is it a security risk?

I would call it a minimal security risk in most contexts except a few. If your app contains medical data or allows medical data to be inferred (e.g. if your app was for, say, a HIV support group) then you may be beholden to legislation such as HIPAA, not to mention a moral obligation to protect those names. The same goes for things like dating apps where sexual orientation or gender expression are stored, which may be problematic to some people's family situation, or worse under certain governments. You can continue this line of thinking for other threat models of this ilk; effectively, if the use of your app may indicate behaviour or beliefs that could lead to persecution or harm, then you should strongly consider this while developing a security program around your app.

In some jurisdictions a name alone is considered to be personally identifying information (PII) that you have a duty to protect. In the UK, for example, this is covered by the Data Protection Act (DPA). However, the general way this legislation is written usually only makes you liable if you were negligent. I don't think that storing a name alone, in an app's isolated storage, could be considered negligent. The key factor here is that the PII is stored using standard practices (app isolated storage) on a device that the user controls, and the user is responsible for the security of their own device. If they root their device and install a shady app that steals their data, you cannot control for that.

0

The first and last name are considered "Personally Identifiable Information (PII) and security best practice is therefore not to store it in plaintext. However, it becomes a gray area if that's ALL you are storing, because PII often required first name/last name in conjunction with other info (DOB, SSN, etc). Also, first and last names are not considered sensitive, so it's not the same rules as sensitive PII. Even so, DHS says:

A privacy incident is defined as the actual or potential loss of control, compromise, unauthorized disclosure, unauthorized acquisition or access to Sensitive PII, in physical or electronic form.

The first name and last name are not sensitive, but they are still considered PII and would need to be reported as a breach if it was comprised.

To answer your question, it is an unnecessary risky and goes against security best practices. Even though it is a gray area, I would not personally accept that risk precisely because it's unnecessary and easily fixed.

  • 2
    Information including the user's PII on the user's device is completely different that PII on a device not under the users control such as a server. – zaph Mar 8 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.