Swype makes almost 4000 location requests every day • Hacker News Board

Re: Swype makes almost 4000 location requests every day

#61

Post by e40 » Mon, May 05, 2014, 2:14 PM UTC

sikhnerd wrote: post #7

Every time I see something like this come up, it really makes me wonder how many other apps out there are doing the same thing and getting away with it. Unless you root your phone and use something like the mentioned android firewall, or go whole-hog and install Cyanogenmod, what chance do you have to guard against this? I assume ios users are likely in the same boat, but with even less chance of recourse.

If you're on Android and rooted, use App Ops X. It allows the revocation of individual permissions, like location, wake lock (a battery waster), and others.

Every time I install a new app, I look at Ap Ops X and see what perms it's using and revoke the ones I don't want it to have.

Re: Swype makes almost 4000 location requests every day

#62

Post by e40 » Mon, May 05, 2014, 2:15 PM UTC

davexunit wrote: post #31

sikhnerd wrote: post #7

Every time I see something like this come up, it really makes me wonder how many other apps out there are doing the same thing and getting away with it. Unless you root your phone and use something like the mentioned android firewall, or go whole-hog and install Cyanogenmod, what chance do you have to guard against this? I assume ios users are likely in the same boat, but with even less chance of recourse.

Proprietary applications spy on their users constantly. It's no surprise that Swype is making these location requests. Rooting your phone isn't an answer in itself. Rooting allows you to install a more free Android distro like Replicant or CyanogenMod. However, if you're still using proprietary applications then you haven't accomplished too much. iOS users have no chance at all. There is no freedom in the iThings. Ap…

"However, if you're still using proprietary applications then you haven't accomplished too much."

Wrong. You can revoke the permission to request the location with apps like App Ops X (needs root).

Re: Swype makes almost 4000 location requests every day

#63

Post by bentcorner » Mon, May 05, 2014, 2:16 PM UTC

jnbiche wrote: post #25

userbinator wrote: post #17

The official response is that location data is used for "regional dialects"... makes sense, but is IP geolocation not close enough? The screenshot there doesn't make it clear but is this coarse or fine location data? My keyboard, no matter how smart, shouldn't need to know where exactly it is on Earth to within a few meters. Within a state or town, fair enough.

I think this is poor user UI. I mean, in this day in age when so many people travel through different countries weekly on pleasure or business, their keyboard layout changes accordingly? That doesn't make much sense.

I don't think the keyboard changes UI - from the description it sounds like they augment the dictionary with words that other people near you are using in their vocabulary.

Still, it doesn't make a lot of sense that they need to do that many location requests. Why should where I'm standing right now affect what words are in my dictionary? It's a poor proxy at best, the words that I use in my language are a product of both where I grew up and where I spend my time. Where I happen to be standing does not always matter that much.

I wonder if bucketing users into "these people use the same words" would give better results?

Re: Swype makes almost 4000 location requests every day

#64

Post by benzoate » Mon, May 05, 2014, 2:16 PM UTC

gorhill wrote: post #53

Kiro wrote: post #23

Earlier quoted context omitted.

Yes, BBC Weather. That's it. They are part of this mega anti-privacy NSA conspiracy too!

You say this as if it is silly to ask why such an app needs write-access to the USB storage. Why do you think it is not a legitimate question?

I assume it's for caching data/images. Way back when, many Android devices were handicapped by their tiny internal storage

Re: Swype makes almost 4000 location requests every day

#65

Post by jchung » Mon, May 05, 2014, 2:18 PM UTC

sikhnerd wrote: post #7

Every time I see something like this come up, it really makes me wonder how many other apps out there are doing the same thing and getting away with it. Unless you root your phone and use something like the mentioned android firewall, or go whole-hog and install Cyanogenmod, what chance do you have to guard against this? I assume ios users are likely in the same boat, but with even less chance of recourse.

I feel the same way. After the whole flashlight app data harvesting debacle on Android, I haven't been able to find a flashlight app for my phone that doesn't give me privacy goosebumps.

Re: Swype makes almost 4000 location requests every day

#66

Post by fooqux » Mon, May 05, 2014, 2:19 PM UTC

oshepherd wrote: post #56

userbinator wrote: post #33

Earlier quoted context omitted.

Why wouldn't Google want users to have such powerful control over their devices? It's always explained like this: Because it's "simpler." Because "things will break if the user does something wrong." Because "the average user won't need it." Those same poor excuses have been responsible for so much loss of privacy and freedom elsewhere, not just by Google. To me, they're deliberately preventing users from having too…

So I have an application which can attach location information to posts made from it. It requests access to location data (as is necessary) when installed, then lets you turn that feature on or off from an internal setting. The request for location data implies the usage of the location feature, so the Android package manager won't let you install it on devices without a coarse location provider. Therefore, like most…

Any programmer worth their salt should, whenever doing any sort of IO (regardless of hardware, cloud, or otherwise) should be making sure they get a sane result/object back. Purely anecdotal here, but I run XPrivacy and have the vast majority of my apps blocked from location. You'd think my phone would barely work, but it actually works fine. I don't think I've ever had an application crash from lack of GPS.

Part of why they don't crash is the multi-threaded nature of how the location API works in Android. High level: you basically of instantiate the location object at the start of your thread, and give it a call back function to call once it has a location for you. You don't know when/if you will ever get a callback, so you have to put some checks in.

Re: Swype makes almost 4000 location requests every day

#67

Post by genericuser » Mon, May 05, 2014, 2:23 PM UTC

userbinator wrote: post #17

The official response is that location data is used for "regional dialects"... makes sense, but is IP geolocation not close enough? The screenshot there doesn't make it clear but is this coarse or fine location data? My keyboard, no matter how smart, shouldn't need to know where exactly it is on Earth to within a few meters. Within a state or town, fair enough.

I have noticed that Swype is really good at guessing names of streets and restaurants and bars, and other proper noun locations I am physically close to (like walking distance) and much worse at completing correctly things farther away (like 20 min drive away).

If it is checking location data for location specific words it there should me a minimum time between checks as location can can't really change enough to matter in the 20-30 sec it currently uses.

Re: Swype makes almost 4000 location requests every day

#68

Post by Zigurd » Mon, May 05, 2014, 2:23 PM UTC

Karunamon wrote: post #59

userbinator wrote: post #33

Earlier quoted context omitted.

Why wouldn't Google want users to have such powerful control over their devices? It's always explained like this: Because it's "simpler." Because "things will break if the user does something wrong." Because "the average user won't need it." Those same poor excuses have been responsible for so much loss of privacy and freedom elsewhere, not just by Google. To me, they're deliberately preventing users from having too…

Or, rather, it could be because the feature was unfinished and tended to crash applications when they don't get the stuff that's called for (and the user authorized) on the permission manifest. http://pocketnow.com/2013/12/17/app-ops Something something malice stupidity. But no, let's bring out the torches and pitchforks...

This is about the easiest change for developers to accommodate. All they need to do is handle one exception.

Most of the permission bloat on Android comes from ad network libraries that do a crappy job of behavioral targeting anyway. Turning off that kind of obnoxious data exfiltration isn't going to hurt anyone, least of all the user.

I don't recall there being an outcry over how painful it was to use permission revocation.

Re: Swype makes almost 4000 location requests every day

#69

Post by rasz_pl » Mon, May 05, 2014, 2:24 PM UTC

huxley wrote: post #52

scep12 wrote: post #46

Earlier quoted context omitted.

The "App Ops" settings that they accidentally released seems evident enough that the feature is forthcoming. Am I missing something?

No it just means that there is permissions infrastructure not that they intend to make it available. What would show Google working actively would be to modify APIs or provide solid guidelines for developers to ensure that arbitrarily closed permissions didn't cause an app to crash or freeze. Making app privacy a high priority for future Android development would be clearly working towards it. Having a hidden privacy…

no need to change APIs, just let AppOps insert shim between apps and API calls and return empty datasets instead of null/failing whole calls.

Let that app ask for my location, but let me define location it returns when I refuse real location. Same for contacts/messages.

Re: Swype makes almost 4000 location requests every day

#70

Post by gorhill » Mon, May 05, 2014, 2:26 PM UTC

benzoate wrote: post #64

gorhill wrote: post #53

Earlier quoted context omitted.

You say this as if it is silly to ask why such an app needs write-access to the USB storage. Why do you think it is not a legitimate question?

I assume it's for caching data/images. Way back when, many Android devices were handicapped by their tiny internal storage

I question the snarkiness of his comment.

I want to understand why he thinks it is silly to question the requirement to agree to the permission.