Scan results

Recommendation: Acceptable With Caution

Essential for German eID authentication and government services. Strong privacy is verified across the entire codebase, with all network communication restricted to BSI and Governikus-operated servers. Two moderate code issues affecting the eID workflow service and authentication flow handling should be addressed by the developer in a future update.

Key Findings

Data Security - 2 findings (2 info)

Network Security - 4 findings (1 low, 3 info)

Code Safety - 3 findings (2 medium, 1 info)

Privacy - 2 findings (1 low, 1 info)

Privacy Concerns

What Data is Collected

• Device information: NFC reader events and protocol state transitions during eID authentication sessions
• Usage data: Log entries including which government services you authenticated with (stored locally, only shared if you manually initiate log sharing)

Third-Party Data Sharing

No third-party data sharing was identified in this analysis. All network communication targets servers operated by Governikus GmbH on behalf of the Federal Office for Information Security (BSI). The Play Store declaration of "No data collected" and "No data shared with third parties" is confirmed by code review.

Understanding the Scores

Security: 93/100
Privacy: 98/100

Security Breakdown

• Data Security: 100/100 - App backup is blocked at multiple levels, preventing eID-related data from being exported via cloud backup or device transfers
• Network Security: 99/100 - Encrypted connections use government-approved cipher configurations with real-time certificate status checking
• Code Safety: 94/100 - Two moderate issues in the eID service component and authentication flow handling require developer attention

Privacy Breakdown

• Data Collection: 99/100 - Minimal data processing limited to what is required for eID card authentication; no behavioral tracking
• Data Sharing: 100/100 - No data is shared with any third party; all server communication is with BSI and Governikus infrastructure
• User Control: 99/100 - You control when and whether log files are shared; PIN, card access number, and PUK values are never written to logs

Positive Security Features

• Zero third-party analytics, advertising, or crash-reporting libraries present in the codebase
• Screen recording is detected automatically, and sensitive PIN entry screens are protected from screen capture
• App backup is disabled at three independent levels, preventing eID session data from leaking through cloud backup or device migration
• Bundled encryption library (OpenSSL 3.6.2, released April 2026) is current with no known issues as of the analysis date
• Encrypted connections use government-approved (BSI TR-02102-2) cipher configurations with OCSP stapling for real-time revocation checking
• All server communication is restricted to BSI and Governikus-operated endpoints; no external domains are contacted
• Your PIN, card access number (CAN), PUK, and raw card communication data are explicitly excluded from log output

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Log File Path Scoping
   The file sharing component is configured to access the entire cache directory rather than only the logs subfolder. Narrowing this to the specific logs directory would follow the principle of least privilege and reduce the scope of what could be inadvertently shared.

2. Log Content Review
   The authentication URL history included in shareable log files reveals which government services you authenticated with. Consider providing a log-sharing option that redacts service provider URLs before export.

Security Enhancements

1. eID Service Permission Gate
   The local IFD (card reader interface) service is accessible to any installed app without requiring a system-level permission. Adding an OS-level permission declaration would prevent other apps from probing or disrupting the eID authentication subsystem, even if the service's own token checks remain in place.

2. Authentication URL Null Safety
   A missing null check in the authentication flow handler can cause the app to crash when it receives a malformed eID link from a website or another app. Adding a defensive check would prevent an active authentication session from being interrupted by a crafted link.

Technical Context

App Type: Government identity authentication - highly sensitive, official BSI-mandated application
Classes Analyzed: 1,890
Third-Party Services: 6 (Qt6, OpenSSL 3.6.2, AndroidX Core, AndroidX ProfileInstaller, Kotlin, kotlinx.coroutines - all bundled frameworks; no data-receiving services)
Context Tags: government, identity, sensitive_data, nfc

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Governikus GmbH & Co. KG
Version: 2.5.1 (Build 306)
Analysis Date: 2026-04-20
Package: com.governikus.ausweisapp2

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 2.5.1 analyzed on 2026-04-20
• May not reflect server-side security controls
• Cannot detect all runtime behaviors