11.3 Privacy

Software developers need to be concerned with privacy as well as vulnerabilities. Privacy can be a tricky line for software, particularly as it relates to social media. For example, some people can make a case to have all social media posts viewable by anyone - after all, one point of social media is to reach a larger audience. Contrast that with a medical record provider who must keep as much information private as possible. There is a line to balance somewhere in the middle, but that line is not always clear and certainly depends on the users expectations and preferences as well as any laws governing data availability.

 

Application Default Settings

Most software allows tweaking of settings, from preferred language to background color to security considerations. Software developers try hard to make the default settings reasonable. Keep in mind that it may be challenging or impossible to devise default settings which are in the best interest of all users.

Strava

Strava can be a great social application to share workouts with like-minded people and find new places to run or cycle. In 2018, Strava generated heat maps from users such that all users could find common places to run simply by looking at a map. While specific user data was protected, aggregate data was still available. In this case, heat maps were used to identify military bases³⁰.

As well, when running routes are available for anyone to see, it generally becomes trivial to identify where someone lives as their runs often start and stop where they live.

Venmo

Default security settings in Venmo caused some concern. In 2021, Venmo announced that it would be removing the global transaction feed. Until that was released, strangers' transactions would be available for all to see. Indeed this is an invasion of privacy at the least but arguably a security concern. In addition to that, users' friends lists were publicly available, as well, representing a huge security violation.

Broken Access Control

The number one spot in the OWASP Top 10 is "Broken Access Control". This vulnerability, when expressed, can lead to " unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits³¹"

Remember Tony Abbott?

Recall that in the opening story in this chapter, Tony Abbot had his passport information and his phone number exposed. One reason that this happened is because sensitive information was sent to an unauthorized actor. In particular, anyone with the last name and boarding pass number (which was included in the social media photo that Mr. Abbott shared).

An eerily similar (but more widespread) issue happened in Missouri. A website that lists names of teachers in the state and their certifications was flawed in that it also included the social security numbers of the educators (albeit the social security number was not displayed on the screen but was present in the HTML for the site). A reporter named Josh Renaud responsibly disclosed his findings to the organization responsible but then reported on it when the issue wasn’t fixed. While this is not necessarily poor design (when people can right-click and choose “View Source” to reveal private information is never a good idea), politicians made it much worse. Governor Mike Parson accused Renaud of hacking private information. Captain John Hotz from the state police said they were “investigating the potential unauthorized access to Department of Elementary and Secondary Education data.”

The New York Times reporting of the incident highlights the government’s absurd misunderstanding of the law³²:

Mr. Parson, a Republican, said that it was “unlawful to access encoded data and systems in order to examine other people’s personal information.”

He cited a state law that said a hacker was anyone who gained unauthorized access to information or content. He said the reporter had no authorization to “convert or decode” the information on the website.

“This was clearly a hack,” Mr. Parson said, adding that the state would investigate the flaws that were uncovered in the system.

Legal observers said they were perplexed by Mr. Parson’s interpretation of what constituted a hack.

Frank Bowman, a professor of law at the University of Missouri School of Law, said that it was difficult to imagine the prosecution of a reporter who alerted state officials to information he discovered by examining a publicly available website.

The chances of prosecutors going after Mr. Renaud, the reporter, “are between zero and zero,” Professor Bowman said. “They’re not going to embarrass themselves like this.”

Clearly, legislatures are failing to keep up with technology and it is challenging democracy.

30. Strava tweaks map settings that inadvertently displayed military sites
31. A01:2021 – Broken Access Control
32. Governor Accuses Reporter of Hacking After Flaws in State Website Are Revealed