LIFE360 APP REVIEW FULL
LIFE360 APP REVIEW VERIFICATION
LIFE360 APP REVIEW PASSWORD
LIFE360 APP REVIEW SERIES

The former employees spoke to The Markup on a condition of anonymity because they are still employed in the data industry. РІР‚СљReports of hacked accounts are extremely rare and are usually a result of a family member inviting someone, such as a friend, to their shared family account,РІР‚Сњ Life360РІР‚в„ўs Robertson said.Р”Р‡ormer Life360 employees told The Markup that Life360 executives were well aware of the security issues but chose growth and new user features over dealing with a backlog of security improvements. The reviewers did not respond to multiple requests for comment. Life360 did respond to each of the app store reviews that we found, directing users to their support team. Several users claimed that a hacker had logged in to their accounts and was able to view either their real-time locations, their marked places like their homes, or their loved onesРІР‚в„ў real-time location. Life360 users have complained about unauthorized log-ins in multiple posts on social media and in reviews for the Life360 app in the Google Play and iOS app stores. РІР‚СљAn app thatРІР‚в„ўs dealing with child information thatРІР‚в„ўs not at least offering multifactor, thatРІР‚в„ўs straight-up negligence,РІР‚Сњ Jim Manico, the ASVSРІР‚в„ўs project manager said.

In January, the company announced that it would stop selling precise location data (except to AllstateРІР‚в„ўs Arity) but would still supply aggregated location data to the company Placer AI. The Markup previously reported that Life360РІР‚в„ўs vast collection of location data made it one of the largest suppliers of raw data for the location data industry.

LIFE360 APP REVIEW PASSWORD

The platformРІР‚в„ўs lax password policies, apparent lack of log-in attempt limits, and the absence of two-factor authentication is notable considering the sensitive nature of the precise, real-time location data it uses and the fact that children are among its users. The ASVS standard calls for allowing no more than 100 failed log-in attempts per hour on a single account. In both cases, Life360 never blocked future log-in attempts and immediately allowed access once we put in the correct password. We also did this test manually through the app with more than 100 failed attempts with the wrong password followed by a successful attempt with the correct password.

It allowed us to log in when we entered the correct password on the 501st attempt. In addition we host a bug bounty program and run ongoing penetration testing,РІР‚Сњ said Chris Robertson, head of security and cloud operations for Life360, in an emailed statement to The Markup.Р”В«ecause it turns out moving fast and breaking things broke some super important things.Р”Р‡or one of the tests, we set up a script that attempted to log in to one of our accounts on Life360РІР‚в„ўs website using incorrect passwords more than 500Р’В times in just over 16 minutes (after checking an initial checkbox labeled РІР‚СљI am humanРІР‚Сњ). We have a highly experienced security team and conduct both internal and external audits of our platform.

LIFE360 APP REVIEW SERIES

РІР‚СљWe strongly disagree with the implied accusations in your series of questions.

LIFE360 APP REVIEW FULL

You can see the full results of our testing here. We found the app notified users about log-ins from multiple devices and password reset requests but not when the accountРІР‚в„ўs email address, phone number, or password were changed. Life360 partially passed two additional tests that check if a user is notified about account changes. Life360 did pass 11 other of the ASVS tests-for example we verified that users are able to change their password and can useР’В passwords of more than 64 characters.

We found that Life360РІР‚в„ўs app failed to pass six of the 19 tests we were able to conduct for important security features such as limiting failed log-in attempts and verifying that passwords are checked against a set of breached credentials.

LIFE360 APP REVIEW VERIFICATION

The organizationРІР‚в„ўs Application Security Verification Standard (ASVS) is a voluntary industry guideline and also closely follows the National Institute of Standards and TechnologyРІР‚в„ўs (NIST) Digital Identity Guidelines, which are federal standards for user authentication. The Markup tested the Life360 app against a series of standards published by the Open Web Application Security Project (OWASP), a nonprofit foundation that promotes app security standards. Through a series of tests, we found that Life360 doesnРІР‚в„ўt provide several basic security measures to thwart potential hackers, including limiting failed log-in attempts and providing two-factor authentication for accounts.

Life360 app review