Client-Focused Security Assessment of mHealth Apps and Recommended Practices to Prevent or Mitigate Transport Security Issues.

摘要: Background: Mobile health (mHealth) apps show a growing importance for patients and care professionals. Apps in this category are diverse. Some display important information (ie, drug interactions), whereas others help to keep track of their health. However, insufficient transport security can lead confidentiality issues medical professionals, as well safety regarding data integrity. mHealth should therefore deploy intensified vigilance protect This paper analyzes the state apps. Objective: The objectives study were follows: (1) identification relevant apps, (2) development platform test purposes, (3) recommendation practices mitigate them. Methods: Security characteristics assessed, presented, discussed. These used prototypical facilitating streamlined tests For tests, six lists 10 most downloaded free from three countries two stores selected. As some part these top more than one country, 53 unique tested. Results: Out tested European App Stores Android iOS, 21/53 (40%) showed critical results. All 21 failed guarantee integrity displayed. A total 18 leaked private or observable way that compromised between servers; 17 unprotected connections; validate certificates correctly. None utilized certificate pinning. Many employed analytics ad providers, undermining user privacy. Conclusions: many do not apply sufficient measures. common issue was use any kind connection. secure connections only selected tasks, leaving all other traffic vulnerable. [JMIR Mhealth Uhealth 2017;5(10):e147]