9

My employer is a staffing company, and I'm on a 4-month contract with the client. The client gets funding from the National Science Foundation, Bill and Melinda Gates Foundation, and others.

They make an app for kids, used in classrooms.

I've found numerous security flaws in the software. The worst is: When the child student clicks "logout", the system tells them they're logged out, but they're actually not. It's possible to continue to initiate actions through the UI as the child.

I brought it to their attention twice and the managers aren't too concerned. The developer responsible for the system (with custom coded security functions coded by him) was defensive, saying that it probably wasn't a big deal, and it'd be impossible to test. I know this is B.S., of course.

I'm considering my range of options.

(The other security flaws also implicate COPPA because they risk childrens' indentifying data: API keys, to e.g. file storage services, exposed in the app.)

COPPA FAQ

Improve this question
2
  • 10
    Make sure you have written documentation of your objection and identification of the issue and the refusal by management to deal with it. It may get nasty, so protect yourself.
    – Jane S
    Jun 3, 2015 at 23:40
  • @JoeStrazzere No, they don't. The dev told me that they don't need it because when there's a bug, he simply fixes it. ;-) They use Asana, but in a very non-standard way — projects aren't used for projects, etc.
    – senior-dev
    Jun 4, 2015 at 21:04

1 Answer 1

Reset to default
13

You might want to point your client at the TinyCo case, to demonstrate that the risk they are taking is real.

According to the COPPA FAQ you can report violations on the FTC site, or by calling (877) FTC-HELP.

As Jane S says in a comment above, document everything (your specific complaint, how you asked the company to address it, how they replied, dates of all of these interactions, etc).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .