ID based tests removed

[Azulath]

I have noticed that for a while now the IDs in the testing guide have been removed. For example, if I wanted to search for a tests relevant for MSTG-CRYPTO-1I could just search the respective testing page.

I assume there was a good reason for removing it, but I did not see this documented anywhere, which is why I have created this discussion.

[cpholguera]

Hi @Azulath, those were the MASVS v1 IDs (even though they started with MSTG-). After rebranding the project and starting the MASVS v2, we've corrected the prefixes to start with MASVS- instead of MSTG-. See:

https://mas.owasp.org/news/#august-23rd-2022-project-rebranding-to-owasp-mas

https://mas.owasp.org/news/#april-1st-2023-masvs-v200-release

To ease the transition, we'll keeping references to them in the MASTG v1 test cases for some time. For example:

https://mas.owasp.org/MASTG/tests/android/MASVS-STORAGE/MASTG-TEST-0001/

See MSTG-STORAGE-1, MSTG-STORAGE-2 at the top. We recommend that you stop relying on these IDs and use the MASVS v2 ones, in this case MASVS-STORAGE-1. You can use the checklist view to get an overview of the current tests and how they map to the IDs:

https://mas.owasp.org/checklists/MASVS-STORAGE/

In the near future, the MASTG tests will also get their own IDs.

[Azulath]

Thank you @cpholguera, I was not aware of the linked page. Previously, I followed the link posted here ( https://mobile-security.gitbook.io/masvs/security-requirements/0x07-v2-data_storage_and_privacy_requirements ) which leads to. ( https://github.com/OWASP/owasp-mastg/blob/master/Document/0x05d-Testing-Data-Storage.md ) and then searched the linked file for cases like MSTG-STORAGE-1 or similar. (I did notice that the naming was a bit different, but the numbers where the same so I did not have any issues with the mapping on my side.)

Now though, it seems like the like to 0x05d-Testing-Data-Storage.md intends to provide a more thorough understanding of the general subject matter while the last link you posted guides the tester through the test cases, correct?

[cpholguera]

That's right. In v2, we're trying to keep the theory separate and reusable, while keeping the test cases as focused and small as possible. For more info, I'd recommend watching some of our recent talks at https://mas.owasp.org/talks/

And now I understand the confusion better. We haven't updated the gitbook versions in a while as we're relying more on our new website now. Let me see if we can still update the gitbook versions to avoid future confusion. Thank you very much!

[Azulath]

Thank you as well!