Skip to content

MASWE-0070: Inadequate Awareness for Privacy Relevant Actions

MAS Requirement

The app informs the user about the privacy implications before performing an action.

Mappings

MASVS V2: MASVS-PRIVACY-2

CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

Overview

This weakness occurs when an app performs a privacy relevant action without making its scope or material consequences reasonably apparent to the user.

Privacy relevant actions include sharing, exporting, publishing, synchronizing, backing up, changing visibility, responding to a request from another party, or moving data from private app storage to storage or services accessible by other applications, users, or third parties.

The weakness may cause users to disclose different data, disclose data to a broader audience, or create more persistent copies than they reasonably intended. It includes flows where the app honors another party's request for data without clearly showing the user what will be shared and with whom, or allowing the user to control the disclosure. It does not require the underlying processing to rely on consent. The issue is whether the interface allows the user to understand and control the resulting privacy state.

Modes of Introduction

  • Unclear Disclosure Context: The interface or action labels do not clearly identify the affected records, files, accounts, data elements, included metadata, destination, audience, or resulting privacy state, including when responding to another party's request for data.
  • Insufficient Disclosure Review and Feedback: The app does not allow the user to review, control, or confirm a consequential disclosure, or clearly indicate that a high impact or difficult to reverse disclosure has occurred.

Impact

  • Violation of User Privacy: The app can disclose personal or sensitive data to recipients who are not entitled to receive it under the user's sharing choices, resulting in unauthorized exposure of that data.
  • Loss of User Trust: Users can discover that the app shared data without their awareness or control, resulting in reduced confidence in the app and its owner.
  • Legal and Regulatory Non-Compliance: The app can share personal data without adequate transparency or user control, resulting in violations of privacy obligations and potential enforcement action.

Mitigations

  • Provide Clear Disclosure Context and Control: At the point of action, show the affected data, included metadata, destination, audience, and material privacy consequences; before responding to another party's request for data, identify the requester and recipient and allow the user to approve, limit, or decline the disclosure.
  • Support Review and Reversal of Consequential Disclosures: Before completion, allow users to review selected items, recipients, audience, included metadata, and visibility; make the resulting privacy state visible and provide proportionate confirmation or undo mechanisms when practical.

Tests

No Tests Yet

The MASTG doesn't contain any tests for this weakness yet. If you have proposals or would like to work on some, please open an issue in https://github.com/OWASP/mastg/issues indicating the MASWE-0070 mapping, the test titles and a summary of the tests.