4

Disclaimer: The plugin's dev has put a lot of work into it, so I don't wanna talk bad about the plugin!! I'm only working in IT since 2 years and from his Github profile he seems way more experienced, so don't take this as any argument against this plugin. I just want to know in general, how can you make sure that a 3rd party plugin is safe?

Question: How can I ensure that this plugin https://pub.dev/packages/veridflutterplugin is not made by a hacker with bad intention?

If I read to all files in the plugins code: https://github.com/AppliedRecognition/Ver-ID-Flutter and if I don't find any suspicious line of code there + if I compile the code by myself and add it to my project directly -> can I then be sure that the plugin is safe??

With the plugin I could let the users of my app scan an ID or passport + take a selfie and compare the faces of the ID and the selfie to get the user's data and verify the user. This is really awesome and exactly what I need for my app where user's are allowed to rent out items and where I need to have their real identity in case the item gets damaged or stolen.

I fear that if this plugin was written with bad intention the creator could get all my users' ID infos + their selfies, e.g. by sending the info from my app to their server without me noticing, which would enable the plugin/the dev to authenticate at other online services that also use the ID + selfie authentication process, e.g. https://shuftipro.com/document-verification

There are some things that I find a bit suspicious about the plugin:

  • it has 0 stars on pub.dev
  • the website linked on the pub.dev site doesn't work / gets blocked by my browser bc unsecure: appliedrec.com/
  • to use the plugin you need to authorize the plugin developer to "Act on your behalve" on your github account: Github auth request to use veridflutterplugin
Improve this question
1
  • Tangent: There's no easy way to do this kind of facial recognition without it being near-trivial to cheat. You have to detect that the faces are the same, but also that one of the faces is not pre-recorded data.
    – wizzwizz4
    Jul 17, 2022 at 10:56

1 Answer 1

Reset to default
8

We can't tell you what to trust. You mentioned stars for that package on a review website. Looking for social proof is a common way to decide whether something is trustworthy, but of course that is not foolproof. A lot of software with few users is perfectly fine, and some software with lots of users is really problematic.

A big problem with concepts like “trust”, “security”, and “privacy” is that everyone has different requirements. Something that I find acceptable might be unacceptable to you.

This is also not a purely technical problem – certain aspects of security/privacy/trust are instead managed through contracts or other legal means and certifications.

In this particular instance, I have the following observations to make:

  • While the Flutter plugin might be Open Source, the iOS/Android SDKs required to use that plugin are most certainly not. You cannot view the full code of their libraries. Additionally, you will need to request an API key, and the SDK docs mention that your key is only free for the first 30 days…

  • You are concerned that the library might send information to some server. There's no way to tell up front, but that is probably exactly how that plugin works anyway.

  • Normal B2B software makes it fairly clear how it works, in particular how data flows and what runs server-side. This is important for understanding pricing, for SLAs, and for privacy/compliance processes. Normal companies also have a clear sales pipeline.

    The company you found is far from transparent in this regard, which is a bit suspicious.

  • It is very good that you are suspicious when an app requests permissions to “act on your behalf”. Overbroad permissions are a great way to compromise your systems. Unfortunately in this case, this is mostly a really confusing dialog on GitHub's part. The documentation on Authorizing GitHub Apps is really confusing, but indicates that this is standard text, part of all authorization flows, and doesn't actually grant any permissions. There doesn't seem to be a way to properly preview what permissions you actually grant. However, permissions are scoped per-repository and so far the only data requested is your email, so this is possibly safe.

Personally I'd stay clear of that plugin, simply because they are not really transparent about what is going on. I'd also like to point out general issues with facial recognition. Such technology is often less accessible, especially for low-vision users. Facial recognition typically performs worse on people of color. Collecting biometric data is fairly privacy-invasive, and might bring you in conflict with privacy laws in some jurisdictions in which you might operate. I'm for Europe, where such use of facial recognition would almost certainly be straight-up illegal.

Improve this answer
2
  • Re your last paragraph, Facebook only found 19 faces on a family photograph of 20 family members; it didn't recognise my nephew, who has Downs. That kind of thing is completely unacceptable.
    – Michael Kay
    Jul 17, 2022 at 11:22
  • 1
    @MichaelKay It is, it is also very common. Facial recognition is not close to perfect yet, especially if you're not white, not male, etc. Part of that is lack of foresight (not enough 'similar' pictures to train the program on, or in some cases borderline malicious ignorance on the part of the developer, other times it's technical (detecting features on a very dark skin in a poorly lit room simply is difficult, even with non-biased software).
    – Mast
    Jul 17, 2022 at 12:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.