1519765 - Lockbox Android Security Testing

Status: RESOLVED FIXED

(Firefox Graveyard :: Security: Review Requests, task)

Description

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Following on from the iOS review (bug 1453173) we want to security testing of the Lockbox Android client. The repo is:

https://github.com/mozilla-lockbox/lockbox-android/

As part of this review we will also need to review the Android Components used:

• FxA and logins-sync from app-services
• data-protect (and potentially telemetry)

(I might file separate dependent bugs for the testing/auditing of these components once we find out the size/scope of them).

Comment 1

[Paul Theriault [:pauljt] (no longer reading bugmail)]

PRD link: https://docs.google.com/document/d/1FfyD7A0qB-WGT2dx3pA5CzS764DVQyfXLs9RVbEpw0s/edit#heading=h.nz3yfasvpfpu

Comment 2

[Devin Reams]

Notified via email:

• Milestone 11 is done and app is nearly "feature complete" (primarily working on improvements, bug fixes): https://github.com/mozilla-lockbox/lockbox-android/milestones

• Frederick and Paul have been added to bitrise.io to download builds/artifacts: https://app.bitrise.io/app/20089a88380dd14d#/builds

• any email can also be added to Play Store "Alpha" release channel (released ~weekly): https://play.google.com/apps/testing/mozilla.lockbox

Comment 3

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Freddy is working on this.

Comment 4

[Frederik Braun [:freddy]]

Forgot closing this. Report was already sent around to team weeks ago. Link is confidential for now, but here for posterity: https://docs.google.com/document/d/1lWcJ6izPt-ZATMHBkqd6-1a1RMqJnkOBTt75FJrFMCE/edit