Skip to content

MASWE-0071: Inadequate Defaults for Privacy Relevant Actions

MAS Requirement

The app uses adequate defaults for privacy relevant actions.

Mappings

MASVS V2: MASVS-PRIVACY-2

CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

Overview

This weakness occurs when an app uses defaults for a privacy relevant action that expose more data than is necessary for the expected functionality.

Privacy relevant actions include sharing, exporting, publishing, synchronizing, backing up, changing visibility, responding to a request from another party, or moving data from private app storage to storage or services accessible by other applications, users, or third parties.

The weakness may cause users to disclose different data, disclose data to a broader audience, or create more persistent copies than they reasonably intended. The issue is whether the default configuration results in a more exposing privacy state than is necessary for the requested functionality.

Modes of Introduction

  • Unclear Disclosure Context: The interface or action labels do not clearly identify the affected records, files, accounts, data elements, included metadata, destination, audience, or resulting privacy state, including when responding to another party's request for data.
  • Overly Exposing Defaults: The app preselects broader audiences, more data, longer retention, public visibility, or additional recipients when a less exposing default would satisfy the expected functionality.

Impact

  • Violation of User Privacy: The app can disclose personal or sensitive data to recipients who are not entitled to receive it under the user's sharing choices, resulting in unauthorized exposure of that data.
  • Loss of User Trust: Users can discover that the app shared more data, or shared it more broadly, than they reasonably expected, resulting in reduced confidence in the app and its owner.
  • Legal and Regulatory Non-Compliance: The app can share personal data using unnecessarily exposing defaults, resulting in violations of privacy obligations and potential enforcement action.

Mitigations

  • Provide Clear Disclosure Context and Control: At the point of action, show the affected data, included metadata, destination, audience, and material privacy consequences; before responding to another party's request for data, identify the requester and recipient and allow the user to approve, limit, or decline the disclosure.
  • Use Privacy Protective Defaults: Default to the narrowest audience, smallest data set, shortest appropriate persistence, and least exposing destination that supports the requested functionality.

Tests

No Tests Yet

The MASTG doesn't contain any tests for this weakness yet. If you have proposals or would like to work on some, please open an issue in https://github.com/OWASP/mastg/issues indicating the MASWE-0071 mapping, the test titles and a summary of the tests.