Live data from Hacker News

Permissions asked for by Uber Android app

gironsec.com

81–90 of 164 posts

Re: Permissions asked for by Uber Android app

#81
post #47

A LOT of this stuff is pretty easily explainable. They want access to SMS and phone calls because the Uber app uses those things. Camera doesn't seem terribly implausible. IT could be an incoming feature that allows you to take a photo of where you are so that your driver can find you more easily. The WiFi stuff is probably related to location. edit: as pointed out below, this is so that you can take a photo of your…

> I don't see the big OMG SECRET MALWARE scariness.

This is the definition of malware:

n. Malicious computer software that interferes with normal computer functions or sends personal data about the user to unauthorized parties over the Internet.

I'm all for people taking responsibility for their privacy but this is basically what you are saying to people:

"Hey you accepted that list of permissions (or Terms of Service)! What? you didn't expect that your Taxi app is not going to retrieve and store your call logs and other personal information? How silly of you."

This rational among tech people is why there is zero privacy. The myth of consumer choice in the matter. The average person doesn't reasonably expect Uber to be mining this information about them. Merely assuming it is a function of the application.

We in technology know that they can but the average user? Who has responsibility here then? Noone? Uber has an ethical responsibility not to actually abuse this trust from their users IMO. Which is why the inclusion of this library deserves scrutiny.

Re: Permissions asked for by Uber Android app

#82
post #60
post #3

Recall that PUT / DELETE aren’t official HTTP requests, rather extensions implemented via WebDav. Modern applications don’t bother with these requests since its easier / more secure to perform those same actions with a server side language. Apparently the author has not ever heard of REST. I'm a little shocked by that.

Strange blog: + credit card check banner + stolen template notification? http://postimg.org/image/vg3ehzxqb/

It's a joke, "Dumbass!" is shown after clicking it.

Re: Permissions asked for by Uber Android app

#84
post #54
post #5

TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…

Even before this disclosure, the Uber app required a nauseatingly long list of permissions. I wiped an old Android phone, configured it with a dummy Gmail account, and then installed the Uber app there. So it's a dedicated Uber-only phone with no contacts, no personal data, powered off until I need a ride. It's a giant pain in the ass. Kinda happy to see this article, it validates my paranoia in some small way. Now t…

I don't use the Uber app at all; I use m.uber.com via Firefox Mobile, and it works just fine.

Re: Permissions asked for by Uber Android app

#85

There's perfectly reasonable explanation for almost all of these permissions, and there's nothing in this analysis that suggests they're doing otherwise. The only one that I couldn't think of was WRITE_SETTINGS Permissions ACCESS_COARSE_LOCATION & ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET: They need to figure out if you have i…

Can people really not be bothered to enter their CC number?

Also, you can initiate the dialer without the CALL_PHONE permission, the user just has to hit the dial button.

Re: Permissions asked for by Uber Android app

#86
post #5

TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…

This is not something new. I've had LinkedIn and Facebook do this with my personal contacts.

I use disposable emails for every site (www.spamgourmet.com). After installing LinkedIn and Facebook Android apps they started recommending adding old coworkers that I have 0 mutual friends / connections with.

Re: Permissions asked for by Uber Android app

#88
One way to deal with this is to filter all outbound requests and not let the requests that you've identified as "phoning home" to complete. Then, you test the app, if it still works you can continue using it. If it doesn't, you find a different service or you consider re-adjusting your restrictions.

Outbound filtering can quickly highlight any app that tries to call home. Luckily, many apps continue working if you block those calls. YMMV.

Re: Permissions asked for by Uber Android app

#89

There's perfectly reasonable explanation for almost all of these permissions, and there's nothing in this analysis that suggests they're doing otherwise. The only one that I couldn't think of was WRITE_SETTINGS Permissions ACCESS_COARSE_LOCATION & ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET: They need to figure out if you have i…

Side note: Wouldn't it be good if Google required all apps to explain why each permission is necessary, similar to this?

Re: Permissions asked for by Uber Android app

#90

Earlier quoted context omitted.

After all the recent scandals in Uber, how has Google not pushed for a complete overhaul of Uber's leadership already? It has become pretty clear the current leadership has some "issues".

Well I mean, is it actually causing any problems for Uber? Uber has what's pretty close to a monopoly in what it offers, apart from a few cities in the US where Lyft also operates. I would say most people that user Uber are not interested in using the regular local taxi service.

I spoke to a Lyft/Uber driver today in NCY. He said that Uber's losing drivers every day here — about 5% (I don't know where he got those numbers from). He also mentioned that Uber are flat out lying about how much drivers earn, and in some months drivers that aren't on Uber's "favourites" list end up owing Uber for renting the gear instead of earning money.

This reputation is definitely damaging, and it's common knowledge here. Drivers bitch about it. They recommend Lyft.

Post reply on HN