# Security & Privacy Scorecard

## AusweisApp Bund

## What This Means for You

Your eID card interactions are processed entirely by German government infrastructure, with no data sent to advertisers or analytics companies. Two code-level issues allow other apps on your device to interrupt an active identity verification session, so only run this app on devices where you control what else is installed.

## Recommendation: Acceptable With Caution

Essential for German eID authentication and government services. Strong privacy is verified across the entire codebase, with all network communication restricted to BSI and Governikus-operated servers. Two moderate code issues affecting the eID workflow service and authentication flow handling should be addressed by the developer in a future update.

**Best For:** German residents who need to use their national eID card for online government services and official banking authentication

## Key Findings

**Data Security** - 2 findings (2 info)

**Network Security** - 4 findings (1 low, 3 info)

**Code Safety** - 3 findings (2 medium, 1 info)

**Privacy** - 2 findings (1 low, 1 info)

## Privacy Concerns

### What Data is Collected

- Device information: NFC reader events and protocol state transitions during eID authentication sessions
- Usage data: Log entries including which government services you authenticated with (stored locally, only shared if you manually initiate log sharing)

### Third-Party Data Sharing

No third-party data sharing was identified in this analysis. All network communication targets servers operated by Governikus GmbH on behalf of the Federal Office for Information Security (BSI). The Play Store declaration of "No data collected" and "No data shared with third parties" is confirmed by code review.

## Understanding the Scores

**Security:** 93/100
**Privacy:** 98/100

### Security Breakdown

- **Data Security:** 100/100 - App backup is blocked at multiple levels, preventing eID-related data from being exported via cloud backup or device transfers
- **Network Security:** 99/100 - Encrypted connections use government-approved cipher configurations with real-time certificate status checking
- **Code Safety:** 94/100 - Two moderate issues in the eID service component and authentication flow handling require developer attention

### Privacy Breakdown

- **Data Collection:** 99/100 - Minimal data processing limited to what is required for eID card authentication; no behavioral tracking
- **Data Sharing:** 100/100 - No data is shared with any third party; all server communication is with BSI and Governikus infrastructure
- **User Control:** 99/100 - You control when and whether log files are shared; PIN, card access number, and PUK values are never written to logs

## Positive Security Features

- Zero third-party analytics, advertising, or crash-reporting libraries present in the codebase
- Screen recording is detected automatically, and sensitive PIN entry screens are protected from screen capture
- App backup is disabled at three independent levels, preventing eID session data from leaking through cloud backup or device migration
- Bundled encryption library (OpenSSL 3.6.2, released April 2026) is current with no known issues as of the analysis date
- Encrypted connections use government-approved (BSI TR-02102-2) cipher configurations with OCSP stapling for real-time revocation checking
- All server communication is restricted to BSI and Governikus-operated endpoints; no external domains are contacted
- Your PIN, card access number (CAN), PUK, and raw card communication data are explicitly excluded from log output

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Log File Path Scoping**
   The file sharing component is configured to access the entire cache directory rather than only the logs subfolder. Narrowing this to the specific logs directory would follow the principle of least privilege and reduce the scope of what could be inadvertently shared.

2. **Log Content Review**
   The authentication URL history included in shareable log files reveals which government services you authenticated with. Consider providing a log-sharing option that redacts service provider URLs before export.

### Security Enhancements

1. **eID Service Permission Gate**
   The local IFD (card reader interface) service is accessible to any installed app without requiring a system-level permission. Adding an OS-level permission declaration would prevent other apps from probing or disrupting the eID authentication subsystem, even if the service's own token checks remain in place.

2. **Authentication URL Null Safety**
   A missing null check in the authentication flow handler can cause the app to crash when it receives a malformed eID link from a website or another app. Adding a defensive check would prevent an active authentication session from being interrupted by a crafted link.

## Technical Context

**App Type:** Government identity authentication - highly sensitive, official BSI-mandated application
**Classes Analyzed:** 1,890
**Third-Party Services:** 6 (Qt6, OpenSSL 3.6.2, AndroidX Core, AndroidX ProfileInstaller, Kotlin, kotlinx.coroutines - all bundled frameworks; no data-receiving services)
**Context Tags:** government, identity, sensitive_data, nfc

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Governikus GmbH & Co. KG
**Version:** 2.5.1 (Build 306)
**Analysis Date:** 2026-04-20
**Package:** com.governikus.ausweisapp2

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 2.5.1 analyzed on 2026-04-20
- May not reflect server-side security controls
- Cannot detect all runtime behaviors