Given the widespread popularity and quotidian usage of mobile
apps, the issue of privacy should not be forgotten. Last year the
Information Commissioner's Office (ICO)
conducted a thorough privacy review of 21 popular mobile apps,
and recently published a summary of the results on its blog.
Although the findings were not excessively alarming, app developers
should be reminded that their products must ensure a high level of
data security in order to avoid security breaches and subsequent
fines of up to £500,000.
One of the issues found was the use of unencrypted connections
to transmit personal data, allowing attackers to glean information
such as usernames and passwords. Disturbingly, of those apps using
encrypted connections, several failed to check digital certificates
accurately. This meant the ICO was able to successfully carry out
'man-in-the-middle' attacks using fake certificates, and
intercept personal data from transmissions that should have been
secure.
