IHG® Hotel Booking & Deals 3.28.0 (Android / Google Play) on Jul 21, 2016

privacymeteronline
23 июл. 2016 г.
10 мин. чтения

Our examination revealed total 33 items, where were 8 DAR items and 25 DIT items. Among DAR items 1 best item found and among DIT items 2 best items found. Also 0 worst DAR item found and 1 worst DIT items found.

This application is available for Android here. This app was designed to make it easier than ever to research, book and manage your stay at all of your favorite IHG brands - InterContinental® Hotels & Resorts, Hotel Indigo®, Crowne Plaza® Hotels & Resorts, Holiday Inn® Hotels and Resorts, Holiday Inn Express®, Staybridge Suites®, Candlewood Suites®, EVEN™ Hotels and HUALUXE™ Hotels & Resorts. That's more than 4,600 hotels across more than 100 countries. The latest build was released on July 14, 2016.

Let's cite the description of this application below: ------------------------------------------- The IHG® app allows you to book and manage your stays 24 hours a day, 7 days a week- from home or on-the-go. Find hotel deals while exploring your favorite IHG brands including: InterContinental® Hotels & Resorts, Hotel Indigo®, Crowne Plaza® Hotels & Resorts, Holiday Inn® Hotels & Resorts, Holiday Inn Express®, Staybridge Suites®, Candlewood Suites®, EVEN™ Hotels and HUALUXE™ Hotels & Resorts- that’s amazing hotel deals at more than 4,900 hotels, across more than 100 countries! Hotel booking has never been easier! The IHG® mobile app simplifies your hotel booking and management needs with features like: • Guest reviews, from travelers just like you, make it simple to find the perfect hotel for your stay. • Anywhere Check-In notifications- taking out the guesswork of when your room is ready. • Join the IHG® Rewards Club or manage your existing account to effortlessly earn points while you stay. IHG® is the only hotel company that rewards guests for exploring our family of brands. When you stay at three or more IHG brands, you are on the fast-track to Gold Elite or Platinum Elite membership. • Access IHG® Rewards Club Auctions to bid your Rewards Club points for once-in-a-lifetime experiences! • Explore photos, amenities, maps or easily click-to-call the hotel of your choice. • Receive live weather updates- making packing for your stay easier than ever. • View upcoming reservations and past stays or cancel a reservation- all with a simple tap. • Sharpen your global travel knowledge with the IHG® GEOGuessr game. Information and entertainment at your fingertips- traveling has never been more stimulating. • Available in English, English (UK), Arabic, Chinese, French, German, Hebrew, Italian, Japanese, Portuguese (Brazil), Russian, Spanish (Spain) and Turkish. -------------------------------------------

Protection levels.

Locally stored data (Data-at-Rest, DAR). Locally stored data groups include Application Information, Account Information, Loyalty Information, Credentials Information, Log Information, Analytics 'n' Ads Information. The average DAR value is 4.00 points (7.00 points of system protection and 1.00 points of own protection). It is higher than a typical value (3.5 points, where's 7 points of system protection and 0 points of own protection).

Items #1 with average value 3.50 points (7 points of system protection, 0 points of own protection) means data protection levels have following definitions. Frankly talking, extra data found that shouldn't be accessed where system protection case - root/jailbreak is required but not possible without wiping device data, and own protection case - stored as is. - Application Configs ('Application Information' Group) - Different configuration files created by your app, perhaps app permissions. This data item related to mentioned group meant to be any kind of info related to app, app settings, incl. installed apps or installers, - Account Details ('Account Information' Group) - Full info about your account incl. account membership, expiration, profile, linked data and account, etc. This data item related to mentioned group meant to be any info related to profiles, basic credential ids like email or username or phone number plus some more info depends on applications, - Account Details ('Loyalty Information' Group) - Full info about your account incl. account membership, expiration, profile, linked data and account, etc. This data item related to mentioned group meant to be any information related to known reward programs like membership, current rewards, etc., - Log Data ('Log Information' Group) - Logged any data as a solid file or multiparts. This data item related to mentioned group meant to be any information stored in local or network logs, - Device Details ('Analytics 'n' Ads Information' Group) - Includes basic device details plus hardware key and fingerprints as well as IMEI. This data item related to mentioned group meant to be any kind of info related to analytics services like flurry, google analytics, etc. or advertisements, - Credentials (IDs) ('Credentials Information' Group) - Only account IDs like app or 3rd party user IDs incl. emails, phone number, usernames and etc. (depends on apps). This data item related to mentioned group meant to be any types of credentials incl. basic (ids only), passwords, tokens, etc.

Items #2 with average value 7.50 points (7 points of system protection, 8 points of own protection) means data protection levels have following definitions. Frankly talking, complianced but there are publicly known techniques to access the data where system protection case - root/jailbreak is required but not possible without wiping device data, and own protection case - complianced encryption algorithms 'n' security mechanisms implementations. - Credentials (Passwords) ('Credentials Information' Group) - Well known passwords or PINs you're using to get an access to your account (usually worse than tokens because gives a full access to your account). This data item related to mentioned group meant to be any types of credentials incl. basic (ids only), passwords, tokens, etc.

Keep in mind if you're using some Android devices such Samsung or LG that allow to root your device without user action, the system level equals 0 points instead of 7. It means your data can be stolen without involving your actions.

Transferred data (Data-in-Transit, DIT). Transferred data groups include Analytics 'n' Ads Information, Device Information, Credentials Information, Loyalty Information, Account Information, Financial Information, Travel Information, Booking 'n' Purchases Information. The average DIT value is 4.08 points (4.00 points of system protection and 4.16 points of own protection). It is higher than a typical value (4 points, where's 4 points of system protection and 4 points of own protection).

Items #1 with average value 2.00 points (4 points of system protection, 0 points of own protection) means data protection levels have following definitions. Frankly talking, developers & vendors mistakes, no user action required where system protection case - informs if fake certificate imported into a device, and own protection case - transferred as is, perhaps protection mode turn off or doesn't exist or info revealed anyway. - Environment ('Analytics 'n' Ads Information' Group) - Different info about environment of you device incl. apps lists, device info, OS name and versions, updates, list of users, network details, etc. This data item related to mentioned group meant to be any kind of info related to analytics services like flurry, google analytics, etc. or advertisements

Items #2 with average value 4.00 points (4 points of system protection, 4 points of own protection) means data protection levels have following definitions. Frankly talking, data available if it's allowed only and may require user action where system protection case - informs if fake certificate imported into a device, and own protection case - bypassed by fake/stolen root certificates (doesn't check certificate path). - Environment ('Device Information' Group) - Different info about environment of you device incl. apps lists, device info, OS name and versions, updates, list of users, network details, etc. This data item related to mentioned group meant to be details about your device, - Device Data ('Analytics 'n' Ads Information' Group) - Owner Device ID, Owner Device Name, Owner Device OS Name and Version. This data item related to mentioned group meant to be any kind of info related to analytics services like flurry, google analytics, etc. or advertisements, - Credentials (IDs) ('Credentials Information' Group) - Only account IDs like app or 3rd party user IDs incl. emails, phone number, usernames and etc. (depends on apps). This data item related to mentioned group meant to be any types of credentials incl. basic (ids only), passwords, tokens, etc., - Credentials (Passwords) ('Credentials Information' Group) - Well known passwords or PINs you're using to get an access to your account (usually worse than tokens because gives a full access to your account). This data item related to mentioned group meant to be any types of credentials incl. basic (ids only), passwords, tokens, etc., - Credentials (IDs) ('Loyalty Information' Group) - Only account IDs like app or 3rd party user IDs incl. emails, phone number, usernames and etc. (depends on apps). This data item related to mentioned group meant to be any information related to known reward programs like membership, current rewards, etc., - Credentials (Passwords) ('Loyalty Information' Group) - Well known passwords or PINs you're using to get an access to your account (usually worse than tokens because gives a full access to your account). This data item related to mentioned group meant to be any information related to known reward programs like membership, current rewards, etc., - Account Data ('Account Information' Group) - Basic info about account like name, list of sub-account (e.g. financial or other) and some linked data like a phone number. This data item related to mentioned group meant to be any info related to profiles, basic credential ids like email or username or phone number plus some more info depends on applications, - Address Data ('Account Information' Group) - Home, work or another type of owner address stored by apps. This data item related to mentioned group meant to be any info related to profiles, basic credential ids like email or username or phone number plus some more info depends on applications, - Card Short Number ('Financial Information' Group) - Several digits of your card from 4 to 6 first digits and from 6 to 4 last digits. This data item related to mentioned group meant to be any kind of info that describe payments capabilities, - Account Data ('Loyalty Information' Group) - Basic info about account like name, list of sub-account (e.g. financial or other) and some linked data like a phone number. This data item related to mentioned group meant to be any information related to known reward programs like membership, current rewards, etc., - Card Address ('Financial Information' Group) - Home or work address of owner related to his bank account and cards. This data item related to mentioned group meant to be any kind of info that describe payments capabilities, - Tracked Data 'n' Favourites ('Travel Information' Group) - Any kind of favourites data or tracked data marked as desirable by users and for users (Like is that user is on fb messenger, viber, bank client or favourite hotel, room type, flight route, airline). This data item related to mentioned group meant to be any kind of travel info like flight, accommodation, ground transportation, etc., - Tracked Data 'n' Favourites ('Loyalty Information' Group) - Any kind of favourites data or tracked data marked as desirable by users and for users (Like is that user is on fb messenger, viber, bank client or favourite hotel, room type, flight route, airline). This data item related to mentioned group meant to be any information related to known reward programs like membership, current rewards, etc., - Orders & Reservation Details ('Booking 'n' Purchases Information' Group) - Full info about orders, reservations, like ID, date and time, amount of payment, flight routes, hotel or another order details, rules, linked data. This data item related to mentioned group meant to be not assigned yet, - Orders & Reservation History ('Booking 'n' Purchases Information' Group) - Basic info about orders, reservations, like ID, date and time, amount of payment, and place (depends on apps). This data item related to mentioned group meant to be not assigned yet, - Travel Details ('Travel Information' Group) - Full info about accommodation (hotel, address, contacts, room,date and time, facilities, media data), flights (routes, location, date and time, media data) or ground (routes, location, date and time, media data). This data item related to mentioned group meant to be any kind of travel info like flight, accommodation, ground transportation, etc., - GEO Data ('Analytics 'n' Ads Information' Group) - Any kind of GEO info stored as plain text referred to the places or tracked activity. This data item related to mentioned group meant to be any kind of info related to analytics services like flurry, google analytics, etc. or advertisements, - Device Details ('Analytics 'n' Ads Information' Group) - Includes basic device details plus hardware key and fingerprints as well as IMEI. This data item related to mentioned group meant to be any kind of info related to analytics services like flurry, google analytics, etc. or advertisements, - GEO Data ('Travel Information' Group) - Any kind of GEO info stored as plain text referred to the places or tracked activity. This data item related to mentioned group meant to be any kind of travel info like flight, accommodation, ground transportation, etc., - Media Data ('Travel Information' Group) - Any kind of info like images, audios, videos, media notes, etc. This data item related to mentioned group meant to be any kind of travel info like flight, accommodation, ground transportation, etc., - GEO Snapshots ('Travel Information' Group) - Image based snapshots of GEO info referred to the places. This data item related to mentioned group meant to be any kind of travel info like flight, accommodation, ground transportation, etc., - GEO Snapshots ('Booking 'n' Purchases Information' Group) - Image based snapshots of GEO info referred to the places. This data item related to mentioned group meant to be not assigned yet

Items #3 with average value 6.00 points (4 points of system protection, 8 points of own protection) means data protection levels have following definitions. Frankly talking, protection and privacy issues are possible where system protection case - informs if fake certificate imported into a device, and own protection case - own vpn or own crypto but complianced. - Card Short Information ('Financial Information' Group) - Some info about card holder, card number full or short) and expiration. This data item related to mentioned group meant to be any kind of info that describe payments capabilities, - Credentials (Access IDs) ('Credentials Information' Group) - Different tokens used to get an access to your account except passwords but incl. app or 3rd party tokens, secret keys and etc. (usually don't give a full access to your account because based on permissions linked to these access tokens). This data item related to mentioned group meant to be any types of credentials incl. basic (ids only), passwords, tokens, etc.

Keep in mind if you're using out-of-dated Android < 5.0, the system level equals 2 points instead of 4. It means your data can be stolen without involving your actions.

Below you find two infographics summarizing what we described above.

First pic includes info about data items combined into groups and best protected items found.

Second pic includes info about data items separately from group and worst protected items found

Privacy Policy Full application privacy policy is available here. You may find privacy policy details proceeding the link above to compare developer's vision on data protection with our results.