I am totally new in creating Apps and also hope not to be in the total wrong topic. For all the Pros out there – I’m sorry.
First of all I want to create an App for social workers which allows them to connect easier to the kids in a specific area. I think to bulid an app which just shows information is not the problem but I want to go a step further and let user just see what they really interested in. So I think about first typing the zip code and then let them choose wether it wants to see information from school social workers or just from the youth club (or both!).
My question is if their is any way to creat something like this with ionic framework and also if their is a possbility of different backends like it’s in wordpress where not everyone have the same user rights.
I think the law and privacy rules are going to be at least as complicated as programming. I recommend you make a list of every dataset you would need, and then research to determine the laws surrounding those datasets. For example, is posting the names of minor children who are members of the chess team public in all jurisdictions?
Edit: Actually, my recommendation is that you do that research, and then consult an attorney. You’ve got minors, psych issues, health issues, schools. Lots of things to keep straight.
A huge issue that will come up is HIPAA laws / regulations. That’ll come up in any conversation with a lawyer. If you do your own research ahead of time that’s the first thing I would look at.
If there’s one legality that might prevent your app from even being a possibility, that’ll be the one.
That’s a mix of personal opinion and having a sibling that was a social worker for 15 years.
I am about to start work on a new project concerned with care worker making scheduled calls to clients.
My approach to data security is:
The data will be stored/retrieved from firestore - but in numeric form only.
Within the app on the care workers phone will be json files to convert the data into readable form.
The json data to convert the data will be strictly controlled by the care company.
The thinking behind this is that data is never secure - so although the firestore access wlll be password protected without the app’s json file the data it is of little value.
If I’m understanding you correctly, if a blackhat gets access to a copy of the app binary by any means (ripped off a care worker’s device, for example), the whole system is blown, because the decryption keys are universal.
I would instead suggest investigating the Signal protocol. There is a JavaScript implementation that should be adaptable to your situation. I won’t sugarcoat this - it will be considerably more challenging to implement than what you have described here, but this sounds like a situation that calls for it.
I have just one last comment which is before anyone starts doing any actual work, research.
Imo there’s no way a mobile application that has anything to do with patient or client information that has HIPAA standards involved is doable. Not on an individual basis at least.
Perhaps if a healthcare company, etc. Specifically contracts you to do the work and had government approval to do so, otherwise no way.
Thanks @rapropos you are right - in my experience working for companies over the years data security has always been very poor - even with confidential data (such as employee pay details) internally it was easy to get at the data. I just wonder how I get round the problem that the care worker are not computer. savvy and are low paid employees with limited skills.
I would suggest - the harder it is to access the data - the more likely the developer/manager will keep a copy offline - because you fear messing up the passwords and lose all access to the data.
I’ve written one. It predated Whisper, otherwise I probably would have used their protocol. The idea was to provide a secure way for transmitting personal health information to end-users, so what was stored in cleartext on the mobile device was personal information for that device’s owner, only.
The publicly accessible server worked like a giant black box dead drop. It contained a key repository containing RSA public keys for all users of the system and a bunch of AES-encrypted messages. The keys to the encrypted messages were wrapped using the RSA public key of the recipient.
The first time the app was run on a device, it would generate a RSA keypair, store the private key on the device, and upload the public key. When somebody wanted to send them a message, the sending app retrieves their public key, wraps a randomly generated AES key in it, encrypts the message with that AES key, and uploads the encrypted message and wrapped key to the server. The recipient could download the encrypted message, unwrap the key using the private key stored on their device, and then store the message locally in cleartext.
So if somebody cracked the server, they have a bunch of useless garbage. If they steal a user’s device, they have access to that user’s data, only, which is pretty much the situation for any mobile app that stores personal information of any kind. They would have the ability to read future messages to that user until the user reports the device stolen, at which point that key is revoked and the system admin sets them up with a new account.
The app binary contained no secrets; stealing one user’s device would not unlock anything related to any other user.
Subcontractor for an organization pitching corporate HR / health insurance consortia.
The Japanese corporate healthcare system is a bit unusual, in that there are these industrywide groups that are public/private partnerships and operate above the individual company level. As for government auditing/approval, that happened way above my head. I just submitted all the source code and let upstream / potential clients / government orgs perform their own evaluations.
Say I found the rest of your comment (following that) interesting and was considering using it as food for thought as far as security measures.
Does that quote suggest what you implemented is essentially irrelevant at this point? As in, using Whisper is significantly easier and there’s no reason not to use it?
I haven’t evaluated Whisper to the point of actually trying to make something with it, so I can’t speak to that, but I have respect and faith in the people behind it to the point that I would trust it to do what it says it does. I think it is attempting to solve basically a related problem, and would be my first choice if I was starting out again trying to do secure messaging in a mobile app.
That being said, I do think my original design was sound, and would appreciate any comments suggesting otherwise.
As for me, I’m happy to contribute my thoughts on it. It may be a while before I have the ability to form an educated opinion on the matter, but when that day comes, so will my thoughts.
