Google hopes that better badging alerting to independent audits will help Android users in finding more trustworthy VPN apps.
The ad giant and cloud provider has given independently audited apps in its Play store a more visible display of their security credentials, particularly a banner atop their Google Play page.
According to Nataliya Stanetsky of Google's Android Security and Privacy Team, in an announcement, VPN apps are the first to receive this special treatment since they manage a sizable quantity of classified data. Therefore, miscreants frequently target them for subversion.
"When a user searches for VPN apps, they will now see a banner at the top of Google Play that educates them about the 'Independent security review' badge in the Data Safety Section," explained Stanetsky.
Google and the App Defence Alliance (ADA) expanded their partnership last year to incorporate the Mobile App Security Assessment (MASA), which verifies the Android apps comply with OWASP-defined security standards. The ADA was founded in 2019.
The audit isn't very comprehensive. As the ADA's website states, "MASA is intended to provide more transparency into the app's security architecture, however the limited nature of testing does not guarantee complete safety of the application."
Additionally, MASA does not always verify the safety claims made by app developers, according to the ADA. The alliance's MASA endorsement is significant, even though it is understandable that it doesn't want to be held accountable if it overlooks something and an information-stealing app gets through.
Among its many checks, MASA looks for apparent bad practices, such as whether sensitive data is written to application log files and whether the application reuses cryptographic keys for multiple purposes. Even though it's not safe to say that apps are guaranteed to be secure, it's safe to say that you're better off with those that avoid such mistakes.
If MASA fails, there are backup security measures available in the Android ecosystem. As Google proudly declares, when your gibberish translator is offline, it attempts to defend against PHAs and MUwS, or potentially malicious applications and unwanted software. It accomplishes this by collecting information about malicious apps, using machine learning and other techniques, performing static and dynamic risk analyses, and more.