81–90 of 257 posts
Earlier quoted context omitted.
Desktop apps usually have access to everything on your drive or running under the same user.
Yes, obviously it's possible for them to gain access, I'm saying I don't know of any desktop apps that need access to any of that other than one time bookmark importing.
From a reddit comment: > The permissions you see on the install screen are actually triggered by various permissions in the permission group. I've checked Ubers (there's a button on the web play store and you can see it in the manifest), and the only one from the Device and App History group they actually use is "GET_TASKS", or get a list of recently opened apps. > Furthermore, on Lollipop this permission doesn't eve…
Either that's not entirely truthful, or the app permission system is totally broken... Need to find out when you last opened the app? "Get running apps"...?
Earlier quoted context omitted.
Regardless of whether it's a non-issue on Lollipop (or later) or not, it exhibits the intent of Uber. And google is no less: https://www.privateinternetaccess.com/blog/2015/06/google-ch...
And what intent are you implying? Is it not possible that they request these permissions to improve the functionality of the application, and do not in fact actively spy on their users?
I've said it before but I'll say it again: this is why you create a second throw-away Google account and use that to create a new profile on your phone dedicated to snoopy apps. Seriously: screw anyone that thinks harvesting my personal data is the cost I must pay for a cab ride.
I don't think that will solve this particular problem. It wan't your browsing history from the device. What we desperately need is a UL for privacy. Just like UL tests electronics, we need a lab to test these apps for what data they access and how they make use of that data. Then assign a score so consumers can chose not to use services that request unnecessary permissions and misuse your data.
Earlier quoted context omitted.
I don't think that will solve this particular problem. It wan't your browsing history from the device. What we desperately need is a UL for privacy. Just like UL tests electronics, we need a lab to test these apps for what data they access and how they make use of that data. Then assign a score so consumers can chose not to use services that request unnecessary permissions and misuse your data.
No, what we need is the ability to modify the system software on our phones easily to stop this kind of thing. On a normal Unix system you would just run the app as a separate user (or worst case, sandbox it) but on android non of the interfaces (or really much of anything at all) can be controlled by the user.
Earlier quoted context omitted.
And what intent are you implying? Is it not possible that they request these permissions to improve the functionality of the application, and do not in fact actively spy on their users?
I'm sure that you'd be happy to provide them access to your house in order to "improve the functionality of the application".
Earlier quoted context omitted.
> Not 100% sure, but I think the access to contacts is so that you can split ride fares with other people. There's a standard intent to select a contact for purposes like that, and then the app only gets access to the information of that contact. Apps requesting access to contacts get all contacts.
It's actually probably so you can autocomplete a contact as a destination address for your Uber. The same is true in Maps for navigation. Unfortunately UX wins over privacy so launching an intent to pick a contact probably wasn't as elegant as using a unified autocomplete field.
Earlier quoted context omitted.
Either that's not entirely truthful, or the app permission system is totally broken... Need to find out when you last opened the app? "Get running apps"...?
This page has more detail on Android's permissions model: http://developer.android.com/guide/topics/security/permissio... I don't really understand the point of having fine-grained permissions (like READ_CONTACTS), when the user only sees broader permission groups. Can someone shed light on this?
Whoever is in charge of the permission system is absolutely nuts. Or it's designed by the committee from hell. Those are the only reasons I can think of. No one sane would create this.
They actually wanted to "simplify" the permissions system and let the user have more control/understanding. You could argue they've done the first... at the expense of everything else. Half of it seems to have been introduced so "it bugs you less", which is not the point, I want to be bugged (by default) so I know what applications are actually doing. If users wants to "not be bugged" let them manually set it, don't make it default.
I've meant to write a post titled "Android 6 permissions: Still pants" after buying a Nexus 5X and being happy with the phone/camera but utterly disappointed with the "revamped" permission systems:
- Yes sure, because I granted an application "Coarse location data", just go ahead and automatically (WTF?) give it "Fine location data" permissions too, because hey, it's all just "location data" right? Not like I might have wanted to give it coarse and not fine on purpose...
- Want to write contacts? Here's reading too! Want to write texts? Here's reading too! Same as above really. Is the use-case of wanting an application to be able to add to my data (at my request) but never-ever read all my data really that hard to predict?
- You get an Internet, you get an Internet, every application gets an Internet. Because every application needs Internet right? It's not like I'd maybe want to install an application to manipulate a specific file type right now but don't want it connecting all over the net right? Maybe I don't have time to verify it's not nefarious. Maybe I just want control over what applications can actually phone home from my device?
- "Runtime permissions" is hit and miss. Some applications ask and then respect the answer. Others will just pop up the dialog over and over and over again until you accept it... which was not the point.
- READ_PHONE_STATE is still terrible. It's used by app/games to pause tasks when the user gets a phone call but... also gives away the number that's calling you! Of course, nearly every application then requests this. I don't get it, it's yet another obvious use case ("Let the application know the user is busy without leaking any data") that seems to have been glossed over. I thought by this point they'd have a proper IS_USER_BUSY permission that tells applications that you're in a phone call/whatever but doesn't leak any of your personal data *whatsoever".
At this point my next phone will be an iPhone/iOS, even though I don't particularly like them as at least security/sane permissions seems to mean something over there...
-------
Android Uber app code has many suspicious places. For example, it contains a namespace "com.baidu.frontia" and classes there include such code as:
localObject = ((TelephonyManager)localObject).getSubscriberId(); // gets IMSI
((TelephonyManager)localObject2).getDeviceId(); // gets IMEI
localObject1 = ((WifiInfo)localObject1).getMacAddress();
public static void makeCall(String paramString)
public static void sendSMS
I looked quickly through the code and it seems that those methods are never called. They are probably just a part of a library not used in this app. Uber mostly uses baidu maps, authorization and payment API.
So this is information about Uber app that I found in some blog: ------- Android Uber app code has many suspicious places. For example, it contains a namespace "com.baidu.frontia" and classes there include such code as: localObject = ((TelephonyManager)localObject).getSubscriberId(); // gets IMSI ((TelephonyManager)localObject2).getDeviceId(); // gets IMEI localObject1 = ((WifiInfo)localObject1).getMacAddress(); publ…