# A Multi-Tier Security Analysis of Official Car Management Apps for Android
## 6 Dynamic Analysis
### Discussion  
Based on the review done in the previous subsection, the following key observations can be drawn out. First off, with reference to Table 9, nearly one-third of the apps accepted a randomly generated or internet-acquired VIN. Even worse, for those of them that do not require any kind of ownership-proof, it was possible to see information regarding vehicle maintenance, which, although not critical, is certainly privacy-invasive. Second, for most apps, user registration does not mandate a strong password creation policy [120]; this situation stands true for almost the two-thirds of the apps. In addition, nine apps do not provide a password confirmation field, which may lock the user out of their account and subsequently force them to execute a password recovery process. However, if, say, the latter is exercised over email, then its security directly depends on the security of the email service. Interestingly, one app supports password-less user authentication via a one-time code sent over email. This option may seem more secure, but it again relies on the security of the email service, which naturally cannot be guaranteed [121]. Furthermore, the user will be unable to login to the app in absence of an internet connection or if their email service is down.  
Third, a limited, but not insignificant number of apps, perform user registration externally to the app. This may seem harmless, but it is additionally always dependent on the security level of the website per se. Where a 4-digit PIN is required as a supplementary user authentication method, feeble PINs are accepted. This is of major importance because anyone who is able to snatch an unlocked phone can potentially access the app by simply entering \"1234\". More than two-thirds of the apps keep the active session alive even if the app is terminated by the user, without logging out. Obviously, this issue is directly associated with the use of weak PINs. Not less important, during user registration, all apps did accept a disposable temporary e-mail address, like the ones provided by Temp Mail [122]. Clearly, such a practice should not be accepted, because, among others, it is used as a method to create phony accounts or bypass areas that require a registered account. Put simply, the use of a disposable email address in the context of such an app is a clear sign of a user who is likely to engage in shady behavior.  
On the other hand, regarding Table 10, which focuses on VIN-to-owner registration issues, one can infer the following. Some apps apply stricter methods to verify proof of ownership. Precisely, four of them demand in-person contact, while others in addition support on-line registration. Paid subscription is also mandated by seven apps. Secondly, three apps ask for a partial VIN, but this is not a limitation because the same apps demand additional authentication tokens, which in turn require physical access to the vehicle. Nearly one-third of the apps accept registering VINs that belong to unsupported models. Surely, this functionality is without a purpose and may yield unforeseen problems. Furthermore, a number of apps seem to accept the same VIN to be registered with different user (email) accounts, but this is done without verification. Naturally, this issue is directly linked to S1 of Table 9.  
Lastly, similar to the other types of analysis, apps that belong to the same manufacturer group present the same or nearly the same characteristics. This is evident in both Tables 9 and 10.