Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Permissions asked for by Uber Android app

gironsec.com

Post reply on HN
Print view View original

31–40 of 164 posts

Re: Permissions asked for by Uber Android app

#31

Post by api »

rco8786 wrote: post #11
api wrote: post #2

There's a general trend of mobile apps that ask for everything: camera, microphone, sensors, access to local files, WiFi, etc. These are apps (like Uber) with no good reason to need access to such things. In most cases I can think of no good reason for this except either a desire to surveil customers for indirect monetization, or participation in government or private surveillance grid efforts. I've got Lyft on my An…

It's a common practice to do this "just in case" you need the permissions later on. When first installing an app users are likely to hit Ok to whatever, but when permissions change on an update they are hit with another screen that tells them the specific thing you are now asking permissions for.

Sounds like classic poor security UX design -- it encourages people to allow everything, and encourages apps to claim everything.

Re: Permissions asked for by Uber Android app

#32

Post by amirmc »

jpatokal wrote: post #24
dmix wrote: post #5

TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…

Now hold on a sec -- I'll buy that the Uber app appears to have a library compiled into it that could do all of that, which is worrisome enough, but as far as I can see, that blog provides no evidence that Uber is actually phoning home. Anybody up for doing a tcpdump?

> "... but as far as I can see, that blog provides no evidence that Uber is actually phoning home"

That does not make it ok.

Re: Permissions asked for by Uber Android app

#33

Post by anigbrowl »

api wrote: post #2

There's a general trend of mobile apps that ask for everything: camera, microphone, sensors, access to local files, WiFi, etc. These are apps (like Uber) with no good reason to need access to such things. In most cases I can think of no good reason for this except either a desire to surveil customers for indirect monetization, or participation in government or private surveillance grid efforts. I've got Lyft on my An…

Yeah, my T-Mobile account app wants to know about my Photos and wifi status. Of course, after that my automatic photo upload stopped working and I have to sttart Google voice manually because they want me to use a T-Mobile app for international calling via Wifi and buy a new SIM card for the privilege. T-Mobile talks a big game but treats its customers little better than its competitors - I may go back to MetroPCS but I think T-Mobile bought them already :-/

Re: Permissions asked for by Uber Android app

#34

Post by andymcsherry »

There's perfectly reasonable explanation for almost all of these permissions, and there's nothing in this analysis that suggests they're doing otherwise. The only one that I couldn't think of was WRITE_SETTINGS

Permissions

ACCESS_COARSE_LOCATION & ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up

ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET: They need to figure out if you have internet and use it

WAKE_LOCK: Keep the network running so you can get real-time updates about your driver

GET_ACCOUNTS, USE_CREDENTIALS, MANAGE_ACCOUNTS: For logging in with Google

CAMERA: You can take a picture of your credit card for easier entry

CALL_PHONE: So you can call your driver

MANAGE_ACCOUNTS: So they can add your uber account to your phone

READ_CONTACTS: Probably for inviting friends or splitting ride costs

READ_PHONE_STATE: Legacy analytics reasons

WRITE_EXTERNAL_STORAGE: Probably unnecessary, but they are probably just storing data

VIBRATE: For notifications

The rest are for push notifications

As far as the roottools, I know Crashlytics checks for root so they can provide that data in their console for crashes. It's a pretty useful thing to be able to weed crashes from rooted devices out. They usually make very little sense and violate the advertised behavior of the SDK.

Re: Permissions asked for by Uber Android app

#36

Post by _lce0 »

alexbecker wrote: post #8
api wrote: post #2

There's a general trend of mobile apps that ask for everything: camera, microphone, sensors, access to local files, WiFi, etc. These are apps (like Uber) with no good reason to need access to such things. In most cases I can think of no good reason for this except either a desire to surveil customers for indirect monetization, or participation in government or private surveillance grid efforts. I've got Lyft on my An…

It's worth noting that the quick summation of Android permissions given to users isn't quite accurate. There are a limited number of permissions, and many of them (such as SD card read/write access) are very broad. So the summary Google uses is a lay description of the worst possible thing an app could do with those permissions, which may be much more invasive than what it actually does.

The permission model is broken. I should not give permission at install-time, it should be asked at runtime, at OS-level, and I MUST be allowed to say no anytime .. if I trust the app enough, then I should be able to say "allow the app to do that thing for this hour/day/month/always"

why mobile OS authors haven't learn anything from the web security model yet?

Post reply on HN