---
# System prepended metadata

title: Project Proposal - App security in communication platforms

---

# Project Proposal - App security in communication platforms

We were very inspired by the featured project.

### Background

Platforms like Slack, Discord, and Microsoft Teams have been increasingly popular for both work-related and social communication. They allow for third party applications that could open up security risk. Could these applications potentially gain access to private and or secret information from their users? How have these platforms designed their third party API:s to make sure this does not happen?

The companies supporting them are of different size and reputation, this could also affect how much they care about the security of the application.

### The goal of the project

- Survey the attack surface of Slack, Discord, and Microsoft Teams.
- Develop proof-of-concept attack apps. 
- Propose security improvements (if any) to the current model and experiment with them to demonstrate how the proof-of-concept attacks are mitigated.

### Relevance to language-based security

Communication platforms fall under the application level. Since applications are _generally_ implemented using programming languages, language-based security is very relevant to securing them.

### Overview of the planned work, schedule & intermediate goals

We assume that we can start working from study week 2. We think the tasks could overlap a bit.

1. Done Study Week 2: Familiarize ourselves with the applications
2. Done Study Week 5: Survey known exploits/attacks
3. Done Study Week 5: If possible, try to write an malicious extension for one of the communication platforms
4. Done Study Week 7: Explore how such malicious extensions can be mitigated
5. Done Study Week 7: Evaluate if the exploit is notable or if it needs to be combined with more exploits to form a interesting attack
6. Done Study Week 7: First draft

### Target grade

We aim for grade 5. We think the final project will motivate its grade better than we can do now. But it is about a topic that is very relevant to course and for our everyday remote-working lives.
