Repository navigation
iOS and Android: improve platform interaction on notifications #1163
Description
One thing we might want to add to the MSTG is that we should, optionally, try to limit the information shared through notifications when they have a high confidentiality.
Activity
commjoen commentedon Mar 21, 2019
https://developer.apple.com/notifications/
commjoen commentedon Mar 21, 2019
@sushi2k : i guess we can do the same for Android right?
sushi2k commentedon May 1, 2019
Definitely worth mentioning it and describe how to test for it. I also just thought 0x05h and 0x06h is the best place for it, but which MASVS requirement does it touch? Nothing in V6: Platform Interaction Requirements covers it actually https://github.com/OWASP/owasp-masvs/blob/master/Document/0x11-V6-Interaction_with_the_environment.md. Need to think about which requirement it is related to.
Maybe this might be best?
commjoen commentedon May 7, 2019
I guess so :) , that sounds like a good requirement to base it on :)
commjoen commentedon Aug 20, 2019
And do the same for android in this ticket :).
[-]iOS: improve platform interaction on notifications[/-][+]iOS and Android: improve platform interaction on notifications[/+]cpholguera commentedon Oct 10, 2019
Some refs:
cpholguera commentedon Aug 25, 2020
Will be assigned to @0x10f2c (still has to be invited)
0x10f2c commentedon Oct 10, 2020
Hi all, so this got solved on the Android side; I guess the discussion now is if this should be done for the iOS side or not.
On the iOS side each notification is treated as private to the originating app.
I guess we could still mention that sensitive information shouldn't be in notifications anyway as someone could see it on the lock screen assuming notifications are not hidden?
Happy to hear some thoughts and action this.
mateofumis commentedon Aug 16, 2026
I've took a close look at this issue and propose to create a new MASTG-KNOW covering the iOS platform.
It should contain:
Once created the KNOW, we can link it into the MASWE-0037 in the #knowledge section, together with the MASTG-KNOW-0054: App Notifications.
On the Android side, this issue is already covered by the MASTG-KNOW-0054: App Notifications, and therefore it's only necessary to address the iOS side.
cpholguera commentedon Aug 31, 2026
Thanks @mateofumis ! Sounds good about iOS; about Android: wouldn't it be worth reviewing the current (possibly old) content and ensuring it's up to date and it covers everything needed / used by the tests we have?
Feel free to start a PR for all this!
cpholguera commentedon Aug 31, 2026
May be worth checking https://play.google.com/store/apps/details?id=com.drilens.wamr&hl=en_US
Maybe it can be mentioned in the new KNOW; and/or used as inspiration for some demo.