diff --git a/6_conclusion/2_futur.typ b/6_conclusion/2_futur.typ index 6819bae..1c452c5 100644 --- a/6_conclusion/2_futur.typ +++ b/6_conclusion/2_futur.typ @@ -39,5 +39,7 @@ We think that an #API or protocol that merges and delivers in a structured way a Integrating such a protocol into Android would open interesting perspectives. For instance, we could imagine Google requiring applications requesting critical permissions to provide test inputs with a high code coverage (maybe even 100% of coverage). -Those test inputs can then be used to analyse the application dynamically. - +Those tests would incentivise application developers to provide better quality code for applications handling sensitive data, but also to provide solutions for the coverage issue that comes with dynamic analysis. +Requiring a high code coverage would force the developer to supply solutions for situations normally requiring human interaction. +For example, if an application requires the user to authenticate themself, the developer would need to provide a testing account that can then be used for tests and analysis. +Of course, we can expect malicious applications to implement evasion techniques when they detect an analysis following the tests they provided, but code coverage can be checked, and imposing constraints on the coverage of the tests should mitigate evasion.