vfafou Well-Known Member Licensed User Longtime User May 19, 2018 #1 Hello! I would like to ask you if someone has done any modification to any app in order to conform with the new GDPR! My app is using push messages. If you would like, could you tell me how did you encrypt your push messages? Thank you in advance!
Hello! I would like to ask you if someone has done any modification to any app in order to conform with the new GDPR! My app is using push messages. If you would like, could you tell me how did you encrypt your push messages? Thank you in advance!
Erel B4X founder Staff member Licensed User Longtime User May 20, 2018 #2 Why do you need to encrypt the push messages? They are sent to the device over a secure connection anyway. Upvote 0
Why do you need to encrypt the push messages? They are sent to the device over a secure connection anyway.
KMatle Expert Licensed User Longtime User May 20, 2018 #3 I encrypt even push messages. AES is a good choice. See the B4x encryption lib or if you use php to send it search the forum or the www. Upvote 0
I encrypt even push messages. AES is a good choice. See the B4x encryption lib or if you use php to send it search the forum or the www.
Erel B4X founder Staff member Licensed User Longtime User May 20, 2018 #4 You can encrypt everything however it doesn't matter. The data is already encrypted anyway. Upvote 0
udg Expert Licensed User Longtime User May 20, 2018 #5 Why don't you move the encryption chore to the server? As Erel said, the transmission medium is secured by itself, so what you need is just encrypt those data that fall under the "personal and sensitive" definition from the GDPR. AFAIK GDPR mandates for privacy by design (and by default), but the goal remains the protection of personal data of individuals (not businesses). In a DB where you have two tables, Customers and Orders, if they are linked by IDs you may want to encrypt some data in Customers but you don't need any in Orders. This way statistical queries on Orders won't require a decrypt stage. BTW, @KMatle 's approach to encrypt everything should be the safest although I see a potential drawback: if someone decompiles the mobile app than he knows how to decrypt the whole DB, once (and if) he/she can get access to it. Upvote 0
Why don't you move the encryption chore to the server? As Erel said, the transmission medium is secured by itself, so what you need is just encrypt those data that fall under the "personal and sensitive" definition from the GDPR. AFAIK GDPR mandates for privacy by design (and by default), but the goal remains the protection of personal data of individuals (not businesses). In a DB where you have two tables, Customers and Orders, if they are linked by IDs you may want to encrypt some data in Customers but you don't need any in Orders. This way statistical queries on Orders won't require a decrypt stage. BTW, @KMatle 's approach to encrypt everything should be the safest although I see a potential drawback: if someone decompiles the mobile app than he knows how to decrypt the whole DB, once (and if) he/she can get access to it.
Erel B4X founder Staff member Licensed User Longtime User May 20, 2018 #6 The private data on the server should be protected. Encrypting the message itself is redundant as the data is encrypted in the SSL transmission. Upvote 0
The private data on the server should be protected. Encrypting the message itself is redundant as the data is encrypted in the SSL transmission.
vfafou Well-Known Member Licensed User Longtime User May 20, 2018 #7 Hello to all! Thank you for your replies! I forgot to mention that I’m using Erel’s Custom Push Websocket Framework with modifications, under WS protocol and not WSS. Last edited: May 20, 2018 Upvote 0
Hello to all! Thank you for your replies! I forgot to mention that I’m using Erel’s Custom Push Websocket Framework with modifications, under WS protocol and not WSS.
Erel B4X founder Staff member Licensed User Longtime User May 21, 2018 #8 vfafou said: I forgot to mention that I’m using Erel’s Custom Push Websocket Framework with modifications, under WS protocol and not WSS. Click to expand... This is indeed important information. All the posts I made assumed that you are asking about the standard push messages. Upvote 0
vfafou said: I forgot to mention that I’m using Erel’s Custom Push Websocket Framework with modifications, under WS protocol and not WSS. Click to expand... This is indeed important information. All the posts I made assumed that you are asking about the standard push messages.
vfafou Well-Known Member Licensed User Longtime User May 21, 2018 #9 Erel said: This is indeed important information. All the posts I made assumed that you are asking about the standard push messages. Click to expand... Hello Erel! You’re absolutely right! I had to mention this with my first post! So, my right question is: does the simple websocket protocol is encrypted? Thank you in advance! Upvote 0
Erel said: This is indeed important information. All the posts I made assumed that you are asking about the standard push messages. Click to expand... Hello Erel! You’re absolutely right! I had to mention this with my first post! So, my right question is: does the simple websocket protocol is encrypted? Thank you in advance!
Erel B4X founder Staff member Licensed User Longtime User May 22, 2018 #10 You should start a new thread and include all the relevant information. What are you sending? How are you sending it? Why aren't you using wss? Upvote 0
You should start a new thread and include all the relevant information. What are you sending? How are you sending it? Why aren't you using wss?
