Swype makes almost 4000 location requests every day • Hacker News Board

Re: Swype makes almost 4000 location requests every day

#101

Post by jessaustin » Mon, May 05, 2014, 4:21 PM UTC

rasz_pl wrote: post #69

huxley wrote: post #52

Earlier quoted context omitted.

No it just means that there is permissions infrastructure not that they intend to make it available. What would show Google working actively would be to modify APIs or provide solid guidelines for developers to ensure that arbitrarily closed permissions didn't cause an app to crash or freeze. Making app privacy a high priority for future Android development would be clearly working towards it. Having a hidden privacy…

no need to change APIs, just let AppOps insert shim between apps and API calls and return empty datasets instead of null/failing whole calls. Let that app ask for my location, but let me define location it returns when I refuse real location. Same for contacts/messages.

...let me define location it returns when I refuse real location.

This would destroy some apps, e.g. Ingress.

Re: Swype makes almost 4000 location requests every day

#102

Post by evanw » Mon, May 05, 2014, 4:22 PM UTC

I found a similar issue with the Square Register app for Android. CyanogenMod's PrivacyGuard feature tells me it tried to access my location 22,000+ times in a 2-day period: https://twitter.com/evanw/status/453576355284660224/photo/1/...

I assumed this was a programming issue (perhaps unregulated retries) rather than the app legitimately trying to locate me 10,000 times per day.

Re: Swype makes almost 4000 location requests every day

#103

Post by bunderbunder » Mon, May 05, 2014, 4:29 PM UTC

threeseed wrote: post #39

sikhnerd wrote: post #7

Every time I see something like this come up, it really makes me wonder how many other apps out there are doing the same thing and getting away with it. Unless you root your phone and use something like the mentioned android firewall, or go whole-hog and install Cyanogenmod, what chance do you have to guard against this? I assume ios users are likely in the same boat, but with even less chance of recourse.

>I assume ios users are likely in the same boat, but with even less chance of recourse. You assumed wrong. On iOS when an application requests access to your current location the OS shows the user a prompt. If a keyboard replacement app was requesting my location I would be asking serious questions about its intent. iOS has a very well implemented permissions systems that I have no idea why Google hasn't copied yet.…

One nice side effect of this is that on iOS, most apps don't even try to ask for information they don't actually need.

OTOH, there are also no (approved) keyboard replacement apps for iOS. :/

Re: Swype makes almost 4000 location requests every day

#104

Post by icebraining » Mon, May 05, 2014, 4:32 PM UTC

Loughla wrote: post #98

icebraining wrote: post #91

Earlier quoted context omitted.

Swype is paid.

Yes, it is. And yet there are two Samsung phones in my home that come pre-loaded with it. Ergo, free. It honestly never dawned on me that someone would pay for Swype.

By that logic, Windows and Mac OS X are also free.

Swype is bundled, not free. You paid for it by buying the device; it's part of its features.

Re: Swype makes almost 4000 location requests every day

#105

Post by mindslight » Mon, May 05, 2014, 4:35 PM UTC

micampe wrote: post #99

mindslight wrote: post #87

Earlier quoted context omitted.

Erm, no they should not. The same breach of privacy will occur when an app just re-implements the demanding of a permission. "This camera app will not run without access to your list of contacts. Enable Contact List Access and restart to proceed". If the phone is mine, then I should be able to easily set it to lie on my behalf to protect my interests.

On iOS you can disable any permission at any time for any application and it's plainly explicit in the API. I've never seen any application do what you describe. The typical example people make is Facebook, which they assume would block you if denied your location but instead works just fine when you remove access to location, camera, photos, and contacts. I don't see why they would behave differently on Android.

For the straightforward example I gave there would be a backlash, especially for the bigger names. But that doesn't mean it's a stable situation, or that other examples wouldn't escape outrage in a different context - "This video can only be played if you enable Location Permission so that we can verify you are in the correct region."

The goal when designing an interface should be to get it right, not to make something that works for now but will just have to be patched up again later. For many permissions, it would be advantageous for the user to not even outright deny, but to return a subset or otherwise modified data - only one contact group, fixed location data, filtered Internet, etc. This of course sounds like heresy to app developers, and that's exactly the point - it's the user's device.

Re: Swype makes almost 4000 location requests every day

#106

Post by bunderbunder » Mon, May 05, 2014, 4:35 PM UTC

tejaswiy wrote: post #85

matthewmacleod wrote: post #15

Earlier quoted context omitted.

We check for last known location in order to provide regional dialects via Living Language. I'm not saying it's legit or required, but that's their explanation from the link there.

Why don't they just use the current locale info ? Why assume their keyboard is extra special when the user is happy with how the rest of the system is setup?

Looks like Living Language isn't just about figuring out the user's current locale. It's about learning local slang and dialects based on what Swype users are typing, in order to give users a dictionary that's much more specific than something generic like "en-US".

For something like that you'd legitimately want to know where someone is down to the city or even neighborhood. Though checking their location 4000 times/day still sounds egregious to me. And possibly misguided - the way I speak English isn't going to change just because I've gone to Petoskey for the weekend.

Re: Swype makes almost 4000 location requests every day

#107

Post by y4mi » Mon, May 05, 2014, 4:38 PM UTC

thefreeman wrote: post #88

Actually, to me it sounds like a bug with Swype when location access is blocked. The users in the thread with the large amount of requests all have the location permission blocked. Other users with Privacy Guard installed as well (so they can see the amount of location requests) who have not blocked location access report that it only made the request once. So it just sounds like if it fails the initial request it co…

possibly. but its every 20 seconds, not every few minutes…

4000 / 24 * 60 = 4000 / 1440 = 2.777 => 60 / 2.7 = 21 seconds

Re: Swype makes almost 4000 location requests every day

#108

Post by jchung » Mon, May 05, 2014, 4:50 PM UTC

dublinben wrote: post #74

jchung wrote: post #65

Earlier quoted context omitted.

I feel the same way. After the whole flashlight app data harvesting debacle on Android, I haven't been able to find a flashlight app for my phone that doesn't give me privacy goosebumps.

Open Flashlight in F-Droid is open source and GPL. You can verify that it respects your privacy.

Awesome. Just checked. https://github.com/sanbeg/flashlight That's better...

Re: Swype makes almost 4000 location requests every day

#109

Post by thrownaway2424 » Mon, May 05, 2014, 4:50 PM UTC

evanw wrote: post #102

I found a similar issue with the Square Register app for Android. CyanogenMod's PrivacyGuard feature tells me it tried to access my location 22,000+ times in a 2-day period: https://twitter.com/evanw/status/453576355284660224/photo/1/... I assumed this was a programming issue (perhaps unregulated retries) rather than the app legitimately trying to locate me 10,000 times per day.

That doesn't seem terribly unreasonable. Square needs location data because the Square Wallet auto-pay magic is geofenced with respect to the register.

Re: Swype makes almost 4000 location requests every day

#110

Post by drzaiusapelord » Mon, May 05, 2014, 4:50 PM UTC

DominikR wrote: post #40

Maybe this is caused by using Google Play Services to get the location. The location tracking of Google Play Services is basically a black box, that tracks the users movement very accurately. It could be that we don't see the count of location requests Swype made, but instead the count of location requests Google Play Services makes.

Its also incredibly buggy. I've had it drain my battery randomly.

On top of that, I noticed my maps application on my new N5 wasn't working correctly. It seemed to update once and then never again. I went into the location services and there was a EULA waiting for me to say yes to. Once I said yes, it worked, but wow, that's not how to do business. I should get that prompt in the maps app or when the phone boots up the first time. Digging through the menu system in settings is the only way I discovered this.