Android phones are sending significant amount of user data with no opt-out [pdf]

Post by toastal » Wed, Oct 13, 2021, 2:44 PM UTC

bubblethink wrote: post #281

gpvos wrote: post #272

Earlier quoted context omitted.

I don't think this was driven by law, but by an appropriate wish to increase transaction security (you really shouldn't use SMS for this anymore). There are some rules here that are nonsense, such as know-your-customer laws that force me to enter my home address even when the product or service (say, a concert or train ticket) is delivered to me entirely electronically. Most of the move to purely electronic payment i…

I agree that you shouldn't use SMS. My point was that unless the law (if there is one), requires that 2FA be enabled in an accessible way, the banks will do their own thing with the phone push notification system. The 2FA situation is quite bad in the US too, but a small no. of banks do offer TOTP.

Post by amatecha » Wed, Oct 13, 2021, 3:27 PM UTC

radlad wrote: post #306

amatecha wrote: post #235

Earlier quoted context omitted.

Yeah I agree, these settings should be disabled by default and require explicit opt-in. That said, I am impressed by how privacy/security-conscious the OS seems to be otherwise!

Network time is pretty important for things like HMACs.

Post by amatecha » Wed, Oct 13, 2021, 3:31 PM UTC

yc12340 wrote: post #246

amatecha wrote: post #235

Earlier quoted context omitted.

Yeah I agree, these settings should be disabled by default and require explicit opt-in. That said, I am impressed by how privacy/security-conscious the OS seems to be otherwise!

You can't really get rid of connectivity check, because it is a part of public API. Applications use it to check whether a network has internet access. Android itself uses it to detect captive portals and prompt user to authenticate when network requires authentication/payment via a web page.

Post by snypher » Wed, Oct 13, 2021, 4:05 PM UTC

CountDrewku wrote: post #141

snypher wrote: post #100

Earlier quoted context omitted.

If you think Google is adversarial then don't use Gmail; It seems strange to avoid using their 'apps' but continuing to use their products? I think you just handed them that information when you logged into their website.

>I think you just handed them that information when you logged into their website. Obviously and that's my point. You are not going to avoid Google if you use the web. The best you can do is limit exposure. >Google is adversarial then don't use Gmail This is ignorant and unhelpful. Do you think I just decided not to consider that option? I don't have an option. I have to use it for work. This is the problem with the…

Post by selfhoster11 » Wed, Oct 13, 2021, 4:11 PM UTC

TeMPOraL wrote: post #278

Kubuxu wrote: post #152

Earlier quoted context omitted.

Most banks in EU require phone app based confirmations for transfers and other operations (according to PDS2 directive). Visa and Mastercard also introduced 3DSecrue system which piggybacks on the same system of confirmations. Vendors are incentivised to adopt it by lower rates. In essence when paying with card or making a wire transfer (or using some instant transfer method, for example Blik in Poland), you get noti…

Didn't know this was driven by PDS2. As much as I appreciate the convenience, I still find the whole drive fucking annoying - especially that, with all the talk about data portability, I still can't get a simple API endpoint I could point a script at to fetch me my account's balance. Yes, I'm bitter. If there's ever a bank that puts end-user automation first, I'll switch in a second.