4.7 KiB
Security and privacy design
Status: policy for production adapters; foundation demo performs no network or sensor access.
Threats and controls
| Risk | Required design |
|---|---|
| Accidental motion / unexpected TV actions | Explicit foreground arm; neutral recovery; expiry; no power/purchase gestures |
| Delayed/duplicated commands | Phone-issued session + target binding, UUID dedup, sequence, short lifetime; no automatic retry |
| Hostile or malformed TV traffic | Event allowlist, payload limits, typed parser, bounded tasks, timeout; no execution of TV-supplied text |
| Token leak | iPhone Keychain, no watch transfer or cloud sync, redacted logging including WebSocket URL query |
| Local network impersonation | Normal TLS validation, or explicitly reviewed device-scoped first-use pinning; no blanket trust exceptions |
| Old phone/watch pairing | WCSession activation lifecycle, new session on device switch/restart, fail closed on version mismatch |
| Wrong TV / old connection | Stable local TV UUID, generation checks after awaits, cancel pending commands on switch |
Self-signed certificates may be present on compatible TVs. Default trust must fail closed while that behavior is investigated. If the production design uses explicit first-use pinning, show the selected device and certificate fingerprint, record consent and pin only that device. A fingerprint learned from the same unauthenticated connection does not independently prove identity: first-use interception remains a limitation. Never claim pinning solves that first-contact problem. A changed certificate requires reapproval/re-pairing. Do not set global NSAllowsArbitraryLoads or accept all URLSession challenges. Document narrowly necessary ATS settings with real-device evidence.
Data inventory and retention
| Data | Location | Retention / deletion |
|---|---|---|
| TV nickname, local ID, address, capabilities | Phone local store (planned) | Until forget/reset; prevent unintended cloud sync |
| TV token and trust pin | iPhone Keychain (planned) | Until forget/revoke/re-pair; device-bound policy |
| Selected TV label and opaque ID | Watch context (planned) | Replace on selection; clear on forget |
| Raw motion | Watch memory during active session | Discard immediately after bounded processing; no default recording |
| Calibration preferences | Local watch/phone (planned) | User-resettable, no cloud sync by default |
| Diagnostic metrics | Local bounded buffer (planned) | No identifiers/tokens/raw motion; explicit export only |
No backend, account, ads, tracking or analytics SDK is included. Do not declare future data practices as implemented. If motion recordings are required for QA, ask explicit informed consent, store locally outside git, define deletion time and never upload by default. Export only redacted developer-selected evidence.
Keychain accessibility must be chosen against actual locked-phone relay needs. Prefer device-only storage; evaluate WhenUnlockedThisDeviceOnly first and AfterFirstUnlockThisDeviceOnly only if justified by the supported workflow. Locked/unavailable Keychain is a recoverable error, not permission to cache plaintext credentials. Application context is never a credential transport.
Permissions and manifest
Production phone setup will need NSLocalNetworkUsageDescription. Motion capture needs an accurate motion purpose string where required by the adopted API/platform. Add permission strings when adapters are introduced; the demo requests neither. Manual unicast address entry is the baseline. SSDP/multicast discovery and Wake-on-LAN may need separate Apple networking entitlement review; do not enable blanket capabilities speculatively. NSBonjourServices entries apply only to the actual Bonjour service types used, not generic SSDP.
The current PrivacyInfo.xcprivacy describes the current demo's lack of tracking, collection and required-reason API declarations. It is not a release approval or a blanket policy for future code. Re-audit FileTimestamp/SystemBootTime/DiskSpace/UserDefaults and other required-reason APIs, dependency manifests and data flows after each adapter. Declare truthful approved reasons actually applicable to the implementation. The public privacy policy and App Store answers must match the final binary and include support/contact details before submission.
Security tests
Test token revocation and deletion; changed/untrusted cert; unauthorized key send; malformed/oversize events; future/stale timestamps; lost/duplicate messages; wrong session/TV; phone reboot/first unlock; permission denied; network isolation. Never run service-menu or destructive raw-key tests. Secrets must be absent from repository history, screenshots and exported logs.