Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Likely privacy violation and GDPR violation in proposed online PWA approach #195

Closed
potiuk opened this issue Jun 7, 2020 · 27 comments
Closed

Likely privacy violation and GDPR violation in proposed online PWA approach #195

potiuk opened this issue Jun 7, 2020 · 27 comments
Labels
enhancement New feature or request question Further information is requested

Comments

@potiuk
Copy link

potiuk commented Jun 7, 2020 •
edited
Loading

Describe the bug
There is a very likely possibility that the current PWA approach (discussed in #189 ) proposed by application creators and Ministry of Digital Affairs violates privacy and is not compliant with GDPR rules (polish RODO).

To Reproduce

As we extensively discussed in #116 when the server is managed by Minstry of Digital Affairs, the IP address of connecting person should be treated as Personal Data - because Ministry has possibility of connecting the IP address to the actual person. In the light of https://archiwum.giodo.gov.pl/pl/319/2258 and Ustawa z 15 stycznia 2016 r. o zmianie ustawy o Policji oraz niektórych innych ustaw (Dz. U. 2016, poz. 147) the Ministry has the possibility of retrieving personal identiy of people based on the IP address they connect from and the time of connection. Both o which are available on the server side of the server that provides online PWA Application. The application will be connecting periodically and downloading updated PWA application and this will give the Minstry the following information:

  • Who (personally identifiable) installed application
  • Who (personally identifiable) uses the application and how
  • Who (personally identifiable) removed the application (visible by application stopped refreshing)

In my opinion, this violates:

Expected behavior

The PWA application should be embedded in the mobile application. Application should only contact Ministry servers in order to voluntarily upload the information when person is positively diagnosed with COVID-19. The application should not contact the server of Ministry for anything else. This should be audited and verified for every release of the application.
@potiuk potiuk mentioned this issue Jun 7, 2020
Closed
@miklobit
Copy link

miklobit commented Jun 7, 2020 •
edited
Loading

Ja się dołącze do tego issue z pytaniem szczegółowym:
Czy pobieranie danych/kodu przez aplikację PWA z serwerów będzie odbywać się poprzez usługi proxy takie jak np Cloudflare, których specyfika działania (man-in-the-middle) umożliwia zarówno nieuprawnioną ingerencję w przesyłany kod/dane jak i nieuprawnione (na gruncie RODO) gromadzenie informacji o użytkownikach aplikacji ?

@potiuk
Copy link
Author

potiuk commented Jun 7, 2020

Ja też z góry przepraszam za angielski - ale to issue wydało mi się na tyle ważne żeby zobaczyło go Apple i Google (już dostali) w czasie review że stworzyłem je po angielsku żeby nie było problemów ze zrozumieniem przez nich o co chodzi.

@SeraMoon

This comment has been minimized.

Sign in to view
@tomekziel

This comment has been minimized.

Sign in to view
@SeraMoon
Copy link

SeraMoon commented Jun 7, 2020 •
edited
Loading

Additionally in the past

The CBA - Central anti-corruption office (government controlled) used a trojan (also for Android system and iOS system) named "Pegasus" (polish article: https://niebezpiecznik.pl/post/jak-wyglada-rzadowy-trojan-pegasus-od-srodka/).

The trojan has been used for surveilance of Polish citizens.

The trojan has been bought by CBA from HackingTeam (https://niebezpiecznik.pl/post/hacking-team-hacked/) for €200.000.

Due to above, there is needed, the application should not download PWA application from servers!

@KoderFPV

This comment has been minimized.

Sign in to view
@KoderFPV

This comment has been minimized.

Sign in to view
@SeraMoon

This comment has been minimized.

Sign in to view
@KoderFPV

This comment has been minimized.

Sign in to view
@SeraMoon

This comment has been minimized.

Sign in to view
@KoderFPV

This comment has been minimized.

Sign in to view
@SeraMoon
Copy link

SeraMoon commented Jun 9, 2020 •
edited
Loading

[EN VERSION]
Because the application is already available in PLAY - I invite people familiar with quotations of the right to report it as not complying with the provisions of GDPR and EDPB through Google Removals.

An application that violates European law (POLAND still belong to the European Union) and deanonymizing the user by sending his IP to the server of the Ministry of Digitization without the required consent in the form of a dialog box should be removed from there.

{PL VERSION]
Ponieważ aplikacja jest już dostępna w PLAY - zapraszam osoby obeznane z cytatami prawa do zgłoszenia jej jako niespełniającej zapisów GDPR oraz EDPB poprzez Google Removals. Formularz wymaga aby podać cytaty prawa, które są łamane i wskazanie z których ustaw wynika i cytatów wynika fakt, że Ministerstwo ma dostęp do IP użytkowników - pomoże mi ktoś?

Aplikacja łamiąca prawo europejskie (nadal należymy do Unii Europejskiej) oraz deanonimizująca użytkownika poprzez wysyłanie jego IP na serwer Ministerstwa Cyfryzacji bez wymaganej zgody w postaci okna dialogowego powinna zostać stamtąd usunięta.

Niestety mój angielski jest zbyt cienki, abym to opisała poprawnie i zrozumiale, a od jakości opisu zależy czy to zrozumieją i rozpatrzą.

@miklobit
Copy link

miklobit commented Jun 9, 2020

Wygląda na to, że aplikacja ( na razie mamy PWA które ładuje kod ekranów z serwera) , pokazuje ekran z polityką prywatnosci dopiero PO połaczeniu się z serwerem. Czyli nawet jeśli user nie udzieli aplikacji zgody na przetwarzanie danych to i tak rząd ma odnotowane dane (ip) użytkownika, który pobrał aplikację, NIE udzielł zgody na zbieranie jakichkolwiek danych i ją odinstalował.

@SeraMoon
Copy link

SeraMoon commented Jun 9, 2020

Wygląda na to, że aplikacja ( na razie mamy PWA które ładuje kod ekranów z serwera) , pokazuje ekran z polityką prywatnosci dopiero PO połaczeniu się z serwerem. Czyli nawet jeśli user nie udzieli aplikacji zgody na przetwarzanie danych to i tak rząd ma odnotowane dane (ip) użytkownika, który pobrał aplikację, NIE udzielł zgody na zbieranie jakichkolwiek danych i ją odinstalował.

Translated:
It seems that the application shows the screen with the privacy policy only AFTER connecting to the server (for now we have PWA which loads the screen code from the server). If the user does not give consent to data processing, the government still receives the personal data (IP) of the user who downloaded the application. Although s/he did not give consent and uninstalled the application.

Comment:
The above does not meet the minimization of the amount of personal data processing in accordance with GDPR. It also does not meet EDPB requirements.

@KoderFPV
Copy link
Contributor

KoderFPV commented Jun 9, 2020 •
edited
Loading

Problems mentioned in this topic should be resolved very soon with the next major update.

Thanks!

EDIT:
I meant the next minor update.

@SeraMoon
Copy link

SeraMoon commented Jun 9, 2020

Problems mentioned in this topic should be resolved very soon with the next major update.

Thanks!

Not "should" but "will". When (I ask about a date) will be resolved?

next major update.

"Next minor update" or "next update".

When it will be done? @Tarvald

@KoderFPV
Copy link
Contributor

KoderFPV commented Jun 9, 2020

@SeraMoon
I meant the next minor update.

@SeraMoon
Copy link

SeraMoon commented Jun 9, 2020 •
edited
Loading

next minor update.

When? (maximum date)

Please enter a specific date, otherwise I will hate programming in JS5.

@KoderFPV
Copy link
Contributor

KoderFPV commented Jun 9, 2020 •
edited
Loading

@SeraMoon

When? (maximum date)

#189 (comment)

In this comment, @MateuszRomanow estimated building offline PWA version of the app in the between 7 to 10 days.

Today is an official release of ProteGo 4.1.1 on Android.
Next application updates coming soon.

Stay tuned.

@SeraMoon
Copy link

SeraMoon commented Jun 9, 2020

[PL Version]
Upieczone dwie bułki z brzeszczotem w tym temacie:
https://panoptykon.org/wiadomosc/protego-safe-ministerstwo-cyfryzacji-znowu-sie-spieszy
https://panoptykon.org/wiadomosc/protego-safe-czy-panstwo-zasluzy-na-zaufanie-obywateli

[EN Version]
Panoptykon Fundation has written two articles about ProteGO. Both do not predict a good future for the application.
https://panoptykon.org/wiadomosc/protego-safe-ministerstwo-cyfryzacji-znowu-sie-spieszy
https://panoptykon.org/wiadomosc/protego-safe-czy-panstwo-zasluzy-na-zaufanie-obywateli

@SeraMoon
Copy link

Next article about "privacy" in ProteGO-Safe and a thread about WebView and PWA.
https://niebezpiecznik.pl/post/porazek-aplikacji-protego-safe-ciag-dalszy/

@Tarvald BTW. This time it is not me writing about lies. Satisfied?

@SeraMoon SeraMoon mentioned this issue Jun 11, 2020
Closed
6 tasks
@KoderFPV
Copy link
Contributor

KoderFPV commented Jun 12, 2020 •
edited
Loading

We have confirmed information that 4.2 update with offline PWA approach, will be in approx 10 days starting from now :)
More detailed schedule very soon.

@kwiszowaty
Copy link

@Tarvald
Just to be more precise: confirmation was made by minister Zagórski and @MateuszRomanow on our meeting at 08.06.2020. It was sait it will be 7-10 days (meaning 10 as maximum) and you even had a working PoC.
Also during the official conference on the next day it was said that team is working days, nights and weekends to deliver the best solution.

Based on above my expectation is to get new release, without online PWA, not later than 22.06.2020 (in normal circumstances I wouldn't count Saturdays - but these are not normal and as you wrote in other post "every hour matters").

I'm not the only one waiting for this offline release (I believe you noted we are not pushing hard, just waiting to see it happen).
Just a reminder: it is in your best interest to release it ASAP to gain credibility. It is in our best interest to get app that fulfills all statements you declared on conferences.

@KoderFPV
Copy link
Contributor

@kwiszowaty
Sure, fully understood. I think we can consider 10 days as a worst-case scenario.
But we have to wait for a more detailed schedule from @MateuszRomanow

@MateuszRomanow
Copy link
Contributor

@kwiszowaty I confirm our goal to release 4.2 update (with PWA offline) not later than 22.06.2020.

@KoderFPV KoderFPV added enhancement New feature or request question Further information is requested labels Jun 13, 2020
@KoderFPV
Copy link
Contributor

@potiuk
4.2.0 wylądowało w sklepie play z offline PWA.

@maxxieb maxxieb closed this as completed Jul 22, 2020
@SeraMoon
Copy link

@potiuk
4.2.0 wylądowało w sklepie play z offline PWA.

... bez audytu prywatności i bezpieczeństwa przeprowadzonych przed publicznym wydaniem aplikacji.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request question Further information is requested
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
8 participants
@potiuk @miklobit @tomekziel @KoderFPV @MateuszRomanow @SeraMoon @kwiszowaty @maxxieb