PRESTO Security & Privacy Scorecard
Android
In-app behavior is tracked by Firebase and shared with Facebook, connecting transit and payment habits to advertising networks. Payment information is processed by a third-party gateway. Data sent between the app and its servers travels with less protection than expected, which could affect account or card details.
Best for
Daily commuters comfortable with analytics tracking
Avoid if
You prefer Facebook not linked to your transit use
Findings
- 0 critical
- 0 high
- 0 medium
- 0 low
- 0 info
0 issues identified across security and privacy analysis.
Top security issues
- WebView JavaScript Interface RCE Vectors - 6 activities expose @JavascriptInterface methods enabling remote code execution and account takeover via MITM attacks
- SSL Certificate Validation Bypass - Connections proceed despite SSL errors, enabling man-in-the-middle attacks on authentication and payment flows
- Hardcoded API Subscription Keys - 5 Azure API keys trivially extractable from public APK enabling direct backend access and quota exhaustion attacks
Top privacy issues
- Firebase Analytics Auto-Tracking Without Consent - Systematic GDPR violation with 98+ tracking points collecting device fingerprints, PII, and behavioral data without opt-in
- Facebook SDK Auto-Logging Enabled - User data shared with Facebook without consent, violating GDPR and potentially constituting 'sale' under CCPA
- Android ID Persistent Tracking - Non-resettable device fingerprint sent in every request, violating GDPR right to erasure and enabling cross-account tracking
Full analysis
PRESTO
What This Means for You
In-app behavior is tracked by Firebase and shared with Facebook, connecting transit and payment habits to advertising networks. Payment information is processed by a third-party gateway. Data sent between the app and its servers travels with less protection than expected, which could affect account or card details.
Recommendation: Use With Caution
Best For: Daily commuters comfortable with analytics tracking
Avoid If: Users who prefer Facebook not linked to their transit use
Key Findings
Data Security - 4 findings (2 critical, 2 medium)
Network Security - 2 findings (1 critical, 1 medium)
Code Safety - 0 findings
Privacy - 4 findings (2 high, 2 medium)
Privacy Concerns
What Data is Collected
PRESTO collects transit usage patterns, payment card details, and in-app behavioral data. Account activity, including travel history and payment records, is retained to support app functionality and analytics reporting.
Third-Party Data Sharing
Behavioral and usage data is shared with the following third-party services:
- Firebase Analytics - behavioral tracking and usage analytics
- Firebase Crashlytics - crash and performance reporting
- Facebook SDK - advertising and behavioral profiling
- Microsoft MSAL (Azure AD B2C) - identity and authentication services
- Moneris Payment Gateway - payment processing
- Azure Notification Hub - push notification delivery
Understanding the Scores
| Category | Score |
|---|---|
| Security | 35/100 |
| Privacy | 45/100 |
| Data Security | 40/100 |
| Network Security | 30/100 |
| Code Safety | 35/100 |
| Data Collection | 50/100 |
| Data Sharing | 45/100 |
| User Control | 40/100 |
Positive Security Features
- No notable positive security features were identified in this version of the app.
Areas for Improvement
- Data in transit is not adequately protected, meaning account details or payment card information may not be fully protected during use.
- The app shares behavioral data with Facebook, giving an advertising network access to transit and payment habits with limited controls available to users.
- The scope of data collected and retained goes beyond what is needed for a transit payment service, limiting users' ability to manage their personal information.
About This Analysis
App Details
| Field | Value |
|---|---|
| App | PRESTO |
| Package | com.metrolinx.presto.android.consumerapp |
| Version | 2.1.24 |
| Scan Date | 2026-01-31 |
| Platform | Android |
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 40/100 |