Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Swype makes almost 4000 location requests every day

forum.swype.com

Post reply on HN
Print view View original

81–90 of 168 posts

Re: Swype makes almost 4000 location requests every day

#81

Post by Karunamon »

madeofpalk wrote: post #76
Zigurd wrote: post #68

Earlier quoted context omitted.

This is about the easiest change for developers to accommodate. All they need to do is handle one exception. Most of the permission bloat on Android comes from ad network libraries that do a crappy job of behavioral targeting anyway. Turning off that kind of obnoxious data exfiltration isn't going to hurt anyone, least of all the user. I don't recall there being an outcry over how painful it was to use permission rev…

> This is about the easiest change for developers to accommodate. All they need to do is handle one exception. But apps didnt have to handle that exception before. If permissions are rejected, it should just return empty data.

Random dummy data would be even better - if you return blank, you give the app a way to know that it's being blocked.

Apps are guests in the user's back yard, not the other way around.

Re: Swype makes almost 4000 location requests every day

#82

Post by madeofpalk »

Karunamon wrote: post #81
madeofpalk wrote: post #76

Earlier quoted context omitted.

> This is about the easiest change for developers to accommodate. All they need to do is handle one exception. But apps didnt have to handle that exception before. If permissions are rejected, it should just return empty data.

Random dummy data would be even better - if you return blank, you give the app a way to know that it's being blocked. Apps are guests in the user's back yard, not the other way around.

Apps should be able to know what permission they currently have - there's very little (if any) breach of privacy from that.

I'm just talking about preventing apps from crashing if they don't handle revoked permissions properly.

Re: Swype makes almost 4000 location requests every day

#83

Post by Loughla »

gleenn wrote: post #6
mariusz79 wrote: post #2

We, as customers, are being raped by the corporations.. No dinner, no movies, no candles, no Vaseline. The sad thing is, many of the people here are part of the problem.

Your metaphor is pretty harsh but I agree with your sentiment. All these mobile apps need more granular security features, which Google almost released, and the EFF was dying for, but then Google quickly retracted it. Very unfortunate. A keyboard does not need to know your location. Nor do half of the damn apps in my phone. It should be easy to make your phone lie to the app and tell it where ever you want. Same with…

"A keyboard does not need to know your location. Nor do half of the damn apps in my phone. It should be easy to make your phone lie to the app and tell it where ever you want. Same with my contacts."

Free app, good app, private app.

Pick two; someone has to pay for the work.

Re: Swype makes almost 4000 location requests every day

#84

Post by icebraining »

jchung wrote: post #65
sikhnerd wrote: post #7

Every time I see something like this come up, it really makes me wonder how many other apps out there are doing the same thing and getting away with it. Unless you root your phone and use something like the mentioned android firewall, or go whole-hog and install Cyanogenmod, what chance do you have to guard against this? I assume ios users are likely in the same boat, but with even less chance of recourse.

I feel the same way. After the whole flashlight app data harvesting debacle on Android, I haven't been able to find a flashlight app for my phone that doesn't give me privacy goosebumps.

But the flashlight in the data harvesting debacle requested your location. It didn't somehow fetch data that your didn't authorize it to get.

You can just install a flashlight app that only asks for the permission it needs.

Re: Swype makes almost 4000 location requests every day

#85

Post by tejaswiy »

matthewmacleod wrote: post #15
sz4kerto wrote: post #10

Earlier quoted context omitted.

Dunno. How can you inadvertently request location info when you're implementing a keyboard for Android?

We check for last known location in order to provide regional dialects via Living Language. I'm not saying it's legit or required, but that's their explanation from the link there.

Why don't they just use the current locale info ?

Why assume their keyboard is extra special when the user is happy with how the rest of the system is setup?

Re: Swype makes almost 4000 location requests every day

#86

Post by dilap »

Karunamon wrote: post #59
userbinator wrote: post #33

Earlier quoted context omitted.

Why wouldn't Google want users to have such powerful control over their devices? It's always explained like this: Because it's "simpler." Because "things will break if the user does something wrong." Because "the average user won't need it." Those same poor excuses have been responsible for so much loss of privacy and freedom elsewhere, not just by Google. To me, they're deliberately preventing users from having too…

Or, rather, it could be because the feature was unfinished and tended to crash applications when they don't get the stuff that's called for (and the user authorized) on the permission manifest. http://pocketnow.com/2013/12/17/app-ops Something something malice stupidity. But no, let's bring out the torches and pitchforks...

I'm a user/dev on the iOS side, and you're definitely right that apps need to be coded to specifically handle cases where they don't get permissions, but...

...this stuff is critical! Give the user the control, let them break the apps that are over-using permissions, and let the apps update to fix.

You can do this in a pretty intuitive, nice way too -- include a flag in apps that says they've been updated to handle partial permissions correctly, and then if an app that hasn't been updated crashes w/ reduced permissions, throw up a dialog explaining that (1) the devs need to update the app (2) if the app not crashing is critical for the moment, the user should lift the permissions restrictions.

Arguments for "simplicity" seem unconvincing to me -- you want to avoid non-essential complexity to achieve simplicity, but this stuff is important to all users.

Re: Swype makes almost 4000 location requests every day

#87

Post by mindslight »

madeofpalk wrote: post #82
Karunamon wrote: post #81

Earlier quoted context omitted.

Random dummy data would be even better - if you return blank, you give the app a way to know that it's being blocked. Apps are guests in the user's back yard, not the other way around.

Apps should be able to know what permission they currently have - there's very little (if any) breach of privacy from that. I'm just talking about preventing apps from crashing if they don't handle revoked permissions properly.

Erm, no they should not. The same breach of privacy will occur when an app just re-implements the demanding of a permission. "This camera app will not run without access to your list of contacts. Enable Contact List Access and restart to proceed".

If the phone is mine, then I should be able to easily set it to lie on my behalf to protect my interests.

Re: Swype makes almost 4000 location requests every day

#88

Post by thefreeman »

Actually, to me it sounds like a bug with Swype when location access is blocked. The users in the thread with the large amount of requests all have the location permission blocked.

Other users with Privacy Guard installed as well (so they can see the amount of location requests) who have not blocked location access report that it only made the request once.

So it just sounds like if it fails the initial request it continues to retry every few minutes. In my opinion it seems like a bug rather then anything malicious.

However the posters in the thread do have a good point that there is really no reason for Swype to even need this permission.

Re: Swype makes almost 4000 location requests every day

#89

Post by thefreeman »

IgorPartola wrote: post #18
sikhnerd wrote: post #7

Every time I see something like this come up, it really makes me wonder how many other apps out there are doing the same thing and getting away with it. Unless you root your phone and use something like the mentioned android firewall, or go whole-hog and install Cyanogenmod, what chance do you have to guard against this? I assume ios users are likely in the same boat, but with even less chance of recourse.

The crazy thing about all these rooting methods is that the code is seldom open and in either case they always distribute binaries anyways. Rooting your phone is no guarantee of anything. Edit: think about how this would play out if you were to go on an Apple or Ubuntu forum and someone said "here, run this executable on your laptop to get extra functionality from it. I cannot give you the source because it's secret.…

Actually no. To unlock android devices all you need to do is run "fastboot oem unlock". You can then optionally flash a custom recovery, custom firmware, or just sideload a Superuser apk. At least one of which is open source. https://github.com/koush/Superuser

Re: Swype makes almost 4000 location requests every day

#90

Post by [deleted] »

hengheng wrote: post #57
ultramancool wrote: post #34

Earlier quoted context omitted.

Most (flagship) phones are rooted using an unlocked boot loader... in which case the "rooting methods" you're refering to is just a script to run a few commands to unlock the bootloader in fastboot mode, boot the phone into a temporary recovery system (which are by the way open source) and then use that to modify the OS. You can do it from a CLI yourself if you like. It's just time consuming. Most people just want th…

You'd still have to hand over root permissions to a random binary just the way grandparent described... Even in the play store, 80% of my apps have no authorship that go beyond a Gmail address.

[deleted]
Post reply on HN