Security and Privacy Perceptions of Third-Party Application Access for Google Accounts (Extended Version)

A Web-Based Perioperative Dashboard as a Platform for Anesthesia Informatics Innovation.

One of the greatest features of any Android device is the way it tightly integrates other web-based Google products and services — everything from Gmail to Google Maps — with its own capabilities. So, you’ll need a Google account to access these features. (You don’t need a Google account to use your tablet, but you won’t be able to access the Play Store and other online services without one.) In this chapter, you will learn how to set up your Google account either from your Android tablet or by going directly to Google.com. Of course, if you already have a Google account, you can skip this step entirely, as discussed in the sidebar “Do You Already Have a Google Account?”

Third-party applications frequently request access to various types of user data, such as contacts, photos, and location, to provide enhanced functionality and improve user experience. For instance, social media platforms may integrate with third-party apps that facilitate post scheduling, engagement analytics, or introduce additional features not available on the platform itself. However, enabling these capabilities often requires granting third-party apps permission to access sensitive data, which introduces potential privacy and security concerns. Once access is approved, these applications can collect, use, and occasionally share user data with other entities, increasing the risk of privacy violations if data protection measures are inadequate or the data is misused. Granting such permissions may expose users to security vulnerabilities, particularly if the third-party apps lack robust security frameworks, making user data susceptible to hacking or unauthorized access.

Third-party applications (TPAs) are integral components of managed Kubernetes clusters, but are also frequently exploited in takeover attacks. Recent incidents have demonstrated that TPAs can be weaponized to gain control over clusters. Given their critical role within the Kubernetes ecosystem, it is essential to explore the potential attack surfaces associated with various types of TPAs. To address this, we propose <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math>${\sf KubeSec}$</tex-math></inline-formula>, a framework that systematically investigates these risks by analyzing application permission configurations and component code dependencies. This investigation revealed a significant number of insecure RBAC binding patterns, uncovering 562 such patterns and identifying 375 vulnerabilities linked to 134 CVEs. These vulnerabilities impact millions of users, with an average remediation time exceeding 10 months. All findings have been reported to the relevant teams, leading to the assignment of 21 new CVEs by the community. These results highlight substantial security risks associated with TPAs in Kubernetes clusters and emphasize the urgent need for further research to develop more secure cluster management practices.

The application programming interface (API) as a means of communication to establish a connection with the cloud, which allows storing the vast amounts of heterogeneous data. Data has been steadily growing over the past several years. Software developers can use different data from cloud as convenient ecosystems for developing, deploying, testing and maintaining their software. API provides the archival solution and storing the data in the cloud. This platform also plays an essential role in managing them effectively with improved transfer rates. API is becoming increasingly dynamic and complex day by day. One of the significant challenges faced by us is to develop appropriate individual API and extensible mechanisms for managing and storing the data in the cloud. The objective of this paper is to utilize the storage efficiently based on API capability and analysis of (extreme amounts of) raw heterogeneous data.

From the Author: Top 5 HTML5 Application Programming Interfaces (APIs) 1. Geolocation API Allows you to ask a website visitor for their current geographical location, which can be vital for certain online services. 2. Streams API Gives you live access to modern, web-connected devices that have cameras and microphones. 3. Battery API Shows the status of visitors device battery levels, letting you prompt them to save data when levels are low. 4. Network Information API Monitors the network status of a device. If connection strength is low, you can postpone downloading large files. 5. Web Storage API Makes your site accessible even when a user's device is offline. You can hold copies of files locally, removing the need for internet connection.

This study: 1) characterized the app market by EHR app gallery and type of app; 2) tracked changes in the EHR app galleries from the end of 2019 through 2020; and 3) examined how apps connect to EHR data systems, and if the apps support the HL7 FHIR standard. We developed a program that gathered data from the public app galleries hosted by Allscripts, athenahealth, Cerner Corporation, Epic Systems Corporation, and SMART. Data collection for this study began in December 2019 and ended December 2020. The program was run 11 times during this period, and the data collected were used to generate the findings and trends observed in this study. The total number of unique apps increased from 600 to 734 during the study period. The most common types of apps marketed were intended for administrative (42%) and clinical use (38%). About 1 in 5 apps (22%) described support for the FHIR standard. Support for FHIR varied by intended functionality and gallery. This study provides early insights into the number of third-party apps that are connecting to EHRs, what services they provide, and if these connections use standards-based application programming interfaces (APIs). It is a federal government priority to improve the access and use of electronic health information, including third-party apps that can introduce competition as well as best-of-breed functions and user experiences. This study shows that there is room for growth, and variation exists among some of the largest EHR developers.

Logout in single sign-on systems: Problems and solutions

On social networking sites (SSN) such as Facebook, users tend to share information and engage with third-party applications (apps). However, how knowledgeable, and aware, are users with regard to using a third-party service or app on Facebook? That is, do users really understand what information gets accessed, collected, and how Facebook shares their data with these integrated third-party apps/services? In this paper, Instant Games (IG), which are third-party apps on Facebook, were used to evaluate the user’s understanding and awareness with respect to the following four core domains – data sharing, data collection, permission settings, and privacy policy. Findings showed that users, to a certain extent, understand that their personal information is been shared; however, they are not fully aware of the details regarding what information is being shared, accessed, and collected by the game apps. Furthermore, users are not fully aware with whom their data are being shared or who owns the game with which their social media profile and other personal data are being shared. An online survey was used to collect the data, and gameplay activity was done by the users using the Facebook mobile app. The contributions in this paper are a key step towards understanding the user’s perception regarding data sharing, privacy policy, and privacy control options relating to IG. In addition, the research helps to uncover privacy concerns relating to IG that demonstrate a need for further study and research.KeywordsPrivacyData sharingInstant gamesFacebookSNSAwareness

Today's Android-powered smartphones are equipped with various embedded sensors, such as the motion sensors, the environmental sensors and the position sensors. Many functions in the third-party applications (apps) need to use these sensors. However, embedded sensors may lead to security issues, as the third-party apps can access data from these sensors without claiming any permissions. It has been proven that embedded sensors can be exploited by well designed malicious apps, resulting in leaking users' privacy. In this work, we are motivated to provide an up-to-date overview of sensor usage patterns in current apps by investigating what, why and how embedded sensors are used in all the apps collected from a complete app market. To fulfill this goal, We develop a tool called “SDFDroid” to identify the sensors' types and to generate the sensor data propagation paths in each app. We then cluster the apps to find out their sensor usage patterns based on their sensor data propagation paths. We apply our method on AppChina, a widely used Chinese Android app market. Extensive experiments are conducted and the experimental results show that most apps implement their sensor related functions by using the third-party libraries. We further study the sensor usage in the third-party libraries. Our results show the accelerometer sensor is the most frequently used sensor. Though many third-party libraries use no more than four types of sensors, there are some third-party libraries register all the types of sensors recklessly. These results show the need for better regulating the sensor usage in Android apps.

As the dominant container orchestration system, Kubernetes is widely used by many companies and cloud vendors. It runs third-party add-ons and applications (termed third-party apps) on its control plane to manage the whole cluster. The security of these third-party apps is critical to the whole cluster but has not been systematically studied so far.

BackgroundStability during early postnatal life in preterm infants is related to better outcomes. Although vital signs are monitored continuously in Neonatal Intensive Care Unites, this monitoring does not include all physiological parameters nor data such as movement patterns. Although there are scattered sources of data, there is no centralized data hub for neonates information.ResultsWe have created the first neonate data hub for easy and interactive access to upload or download postural, physiological, and medical data of neonates: NeoVault. NeoVault is a platform that provides access to information through two interfaces: 1) via a Web interface (designed for medical personnel, data scientists, researchers); and 2) via a RESTful API (Application Programming Interfaces) -designed for developers-, aiming to integrate access to information into third-party applications. The web access allows searching and filtering according to specific parameters, visualization of data through graphs and images, and generation of datasets in CSV format. Access through the RESTful API is described in OpenAPI, enabling access to information from any device, facilitating it in an interoperable format. Currently, it contains nearly 800,000 postural records and 3.000 physiological data entries. The physiological and postural data stored for each neonate in NeoVault are collected through the NRP (Neonates Recording Platform) tool, which allows for the automatic and reliable collection of data.ConclusionNeoVault is an open platform for simple access to postural, physiological, and medical data of neonates that can be utilized by researchers, data scientists, medical personnel, and programmers. It enables integration into third-party applications and the generation of customized datasets.

Android has been updating the system of every version it releases. The addition of Application Programming Interface (API) is done every time Google releases a new Android operating system. The availability of APIs for third-party applications provides opportunities for developers to be able to monitor Android smartphones. Just like Google Device Manager which can instruct Android smartphones over the internet network, however, it still has a deficiency that is if the target smartphone in a state of inactive internet. In this research, the author utilizes SMS media to be able to process instructions and access the system API for monitoring purposes. The results of this research is by using SMS then user can instruct Android smartphone to take photos, get current location, ring, delete smartphone files, set screen protection, and backup contact with higher messaging reliability. This application can run well on Android Lollipop 5.1 (API Level 22) or above because it has enough API to support system functionality.

<p xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" class="first" dir="auto" id="d315588e75">Online services are now an essential part of everyday life, with most people having many online accounts. Staff and students at universities have much important information online which needs to be secure. The technologies used for authentication of online accounts as now grown from passwords to a range of different technologies including two-factor authentication (2FA), single sign on (SSO), biometric authentication (most often face or fingerprint recognition), Federated Identity Management (FIM), and Fast Identity Online (FIDO). Research has shown usability issues and user concerns about these technologies. An online survey was undertaken to investigate current levels of use and concerns about seven authentication technologies among British university staff and students. A wide range of technologies was used with passwords still being the most frequently used. Participants’ ratings of ease of use, trust, perception of security and confidence in using the technologies was generally high, and ratings of concerns were low. There were interesting differences between the staff and student samples.

Fifth generation mobile network (5G) will make network services available anywhere from multiple Service Providers (SP) and its provisioning raises security concerns. The users will require seamless connectivity and secure access to these services. Mobile Network Operator (MNO) will want to provide services to users and be able to share infrastructure resources with other MNOs. This requires robust authentication and authorization mechanisms that can provide secure access and provisioning of service to multiple users and providers in heterogeneous network. Therefore, Federated Identity (FId) with Single Sign On (SSO) could be used for seamless access and provisioning to network services in 5G. So, we propose Network Service Federated Identity (NS-FId) protocol, a federated protocol that provides secure access to services from multiple SPs and provides SSO to users. We formally verify and analyse the proposed NSFId protocol using ProVerif. We also conduct a security analysis of the protocol’s security properties.