* A commitment and ability to update any critical security issues for a specified amount of time
* Standardised mechanisms for reporting critical updates to users which are not used for marketing
* A basic checklist of best practice for internal self-audit (SQL injection, plaintext data, enumeration attacks)
A low bar, but still far better than what we've currently got. (External audits are probably silver tier?)
I think this is a massive ask/knowledge expectation for the average person. A simple warning label about changing the device password from the default would be a major step in the right direction for consumers.
- 2-factor auth support
- federated login support (i.e. login with Google/Facebook/etc buttons)
- some sort of indication of encryption in-flight and at-rest, and who handles the keys (e.g. is there a per-user key that tech support can't even access without user grant, or is there a single hard-codes AES key in the APK etc that everyone knows)
But I can also see how that could be abused by bad actors so I guess it would be a tricky part of the policy to do correctly.