search

MohGovIL / hamagen-react-native

Israel's Ministry of Health's COVID-19 Exposure Prevention App
https://health.gov.il/
MIT License
508 stars 153 forks source link

[Security] Please list every single external service and hosting used by the app in a clear viea in an md and insider the application #236

Open rr9845 opened 4 years ago

rr9845 commented 4 years ago

Following https://cybercyber.co.il/?p=151 , please list every single service the application is uploading information to, and what information is uploaded.

That is requried to have conscious agreement to use the application.

There are different levels of infromation uploaded : From as simple as accessing a remote server and sending some ID headers , to severe when locaiton data is uploaded to a server (should be an optional service and opt-in ) .

For example and I'm not saying each of this actions actually happen , I'm just asking for the real connections to be published:

This application connect and upload xxxx information to firebase which is hosted at google, the information which is uploaded to it is x.y.z Issue 16 and Issue 3

~This application connect server hosted by wix, and retrieve xyz data from there .~

This application connect to azure to retrive location informaiton , during the access the next headers and information is shared with azure.

etc.

E&OE

kaplanlior commented 4 years ago

Regarding your last note in the issue, we don't connect to a wix server.

We do have a component with "wix" in its name, as you can see from #233 . This component is located at https://github.com/MohGovIL/rn-contact-tracing (also referenced by the packages.json file).

rr9845 commented 4 years ago

@kaplanlior I had corrected my text, I only meant that as an example.

However listing the services that this application (and any internal componenet) is connecting to (even as simple as azure and firebase ) is crucial for the transperncy of this application.