742796 - Security review for Identity KPI Backend

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Austin King [:ozten]]

1. Who is/are the point of contact(s) for this review?

ozten

secondary: lloyd or benadida in #identity

2. Please provide a short description of the feature / application (e.g. problem solved, use cases, etc.):

The main objective of this feature/product is: to allow the  BrowserID product team to access how well changes to the service are meeting key performance indicators (KPI). UX will design a feature change, engineering will build it and a KPI Dashboard will give us the  feedback of how successful the change is with real users. 
KPI Backend must be built before we build the KPI Dashboard, which will  be built next quarter and have it's own privacy review. KPI Backend  stores the raw data described below.

3. Please provide links to additional information (e.g. feature page, wiki) if available and not yet included in feature description:

Main Feature Issue - https://github.com/mozilla/browserid/issues/1060
Mailing list discussion - https://groups.google.com/forum/?fromgroups#!searchin/mozilla.dev.identity/learning/mozilla.dev.identity/QqaLjbU8mng/UovZPm7wHfgJ
Privacy Review Information - https://wiki.mozilla.org/Privacy/Reviews/KPI_Backend
Privacy Review Questionnaire - https://privacy.etherpad.mozilla.org/66

4. Does this request block another bug? If so, please indicate the bug number

Not currently.

5. This review will be scheduled amongst other requested reviews. What is the urgency or needed completion date of this review?

We'd like to get the architecture reviewed soon. Completing this stage is a per-requisite for the second stage, which an intern will work on. Not completing the KPI Backend by end of Q2 will put their internship at risk.

6. Please answer the following few questions: (Note: If you are asked to describe anything, 1-2 sentences shall suffice.)
6.1 Does this feature or code change affect Firefox, Thunderbird or any product or service the Mozilla ships to end users?

No, this affects the web based shim for BrowserID.

6.2 Are there any portions of the project that interact with 3rd party services?

No. 3rd party websites are relaying parties which consume BrowserID and we would start capturing interaction metrics, but we have a user data review look at this aspect.

6.3 Will your application/service collect user data? If so, please describe 

Please see https://privacy.etherpad.mozilla.org/66 for full details.

No personally identifiable user information will be collected, but the point of this backend is to collect new data which we haven't collected before. This is user interaction data.

7. If you feel something is missing here or you would like to provide other kind of feedback, feel free to do so here (no limits on size):

8. Desired Date of review (if known from https://mail.mozilla.com/home/[e-mail]/Security%20Review.html) and whom to invite. 

4/17

Comment 1

[Austin King [:ozten]]

> 6.1 Does this feature or code change affect Firefox, Thunderbird or any product or service the Mozilla ships to end users?

> No, this affects the web based shim for BrowserID.

Sorry, I misread this question. Yes it does affect a Mozilla service.

Comment 2

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

(In reply to Austin King [:ozten] from comment #0)

> 8. Desired Date of review (if known from
> https://mail.mozilla.com/home/[e-mail]/Security%20Review.html)
> and whom to invite. 
> 
> 4/17

There are no available dates on the 17th (as we don't have availability on Tues). Please check the calendar for an available date. Also we need to know whom to invite to the meeting from your side. If it is just you then please let us know that.

Comment 3

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

:ozten
can you please pick a date that exists on our calendar?
https://mail.mozilla.com/home/[e-mail]/Security%20Review.html

Comment 4

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

:rforbes / :dchan
I need one of you to please be the lead for review on this bug, potential review next week. Does one of you have the bandwidth for this?

Comment 5

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

due to other assignments this is being assigned to :rforbes as lead

Comment 6

[Austin King [:ozten]]

(In reply to Curtis Koenig [:curtisk] from comment #3)
I'm sorry, I didn't know about this process.

Monday 4/23 1pm looks open. Can we have this slot please?

Comment 7

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

scheduled 
https://mail.mozilla.com/home/[e-mail]/Security%20Review.html?view=month&action=view&invId=130654-130653&pstat=AC&exInvId=130654-166953&useInstance=1&instStartTime=1335211200000&instDuration=3600000

Comment 8

[Raymond Forbes[:rforbes]]

we completed a design review of this.  No code has been written so we have nothing to look at as of yet.  We will need code to review, and a staging version of the API in order to complete this review.

Comment 9

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Review wiki: https://wiki.mozilla.org/Security/AppsProject/IdentityKPIBackend

Comment 10

[Austin King [:ozten]]

There is now code and an environment you can play with. Sorry I didn't update sooner.

http://dev.123done.org/

Comment 11

[Austin King [:ozten]]

(In reply to Curtis Koenig [:curtisk] from comment #9)

Per feedback from @curtisk, I've reworked
https://wiki.mozilla.org/Privacy/Reviews/KPI_Backend#Data_Storage_Component

Comment 12

[Austin King [:ozten]]

@curtisk - Are we good with that format update? Has this moved into review?

Comment 13

[Austin King [:ozten]]

(In reply to Austin King [:ozten] from comment #12)

I see this is moving out of review and I see some new content with yellow blocks that say "Resolution: [new]"

Should I edit that wiki page and respond in the yellow blocks, or what is the next step?

https://wiki.mozilla.org/Privacy/Reviews/KPI_Backend

Comment 14

[Al Billings [:abillings - ex-MoCo]]

Curtis is away for a week and he would know the optimal process here. Since he's gone, I'm going to suggest that you go ahead and edit the wiki page if you have data to add to those sections.

Comment 15

[Austin King [:ozten]]

(In reply to Al Billings [:abillings] from comment #14)

Wonderful. I've prefixed my comments with (ozten).

Except for "document and publish a data collection and retention policy" I don't see any new actions, which haven't been part of another bug or current plan.

Policy:
Where should I file a bug for "document and publish a data collection and retention policy"? We did document aspects of a data collection and retention policy in our user data safety review.

Overall:
Please let us know if you need anything else.

Comment 16

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

We have a "Mozilla" policy for this, joes in the opsec team is responsible for it. That item can remain unfinished, we have other reviews held on this as well. The issue right now is that we need to get it out of Mana and get it publicly published.

Comment 17

[Raymond Forbes[:rforbes]]

i missed the fact that there is code available to look over.  i will do this monday and tuesday this week.

Comment 18

[Raymond Forbes[:rforbes]]

sorry, i blew updating this bug.  vegas does that to me.  i reviewed the code and given that it is behind a vpn, this is fine.

Comment 19

[Austin King [:ozten]]

Comments made on bugzilla in vegas, stay in vegas.

Thanks rforbes!

Comment 20

[Austin King [:ozten]]

@dchan Note: easiest way to start testing dev is to go to http://dev.123done.org/ and us an @yahoo.com email addresses.

Comment 21

[Daniel Veditz [:dveditz]]

I think Curtis's most recent mail is saying that our reviews shouldn't be "VERIFIED" until all the dependent bugs are fixed. Moving back to RESOLVED.