Live data from Hacker News

Permissions asked for by Uber Android app

gironsec.com

91–100 of 164 posts

Re: Permissions asked for by Uber Android app

#92
post #81
post #47

A LOT of this stuff is pretty easily explainable. They want access to SMS and phone calls because the Uber app uses those things. Camera doesn't seem terribly implausible. IT could be an incoming feature that allows you to take a photo of where you are so that your driver can find you more easily. The WiFi stuff is probably related to location. edit: as pointed out below, this is so that you can take a photo of your…

> I don't see the big OMG SECRET MALWARE scariness. This is the definition of malware: n. Malicious computer software that interferes with normal computer functions or sends personal data about the user to unauthorized parties over the Internet. I'm all for people taking responsibility for their privacy but this is basically what you are saying to people: "Hey you accepted that list of permissions (or Terms of Servic…

These items are all to allow the app to do it's job and to make using it as simple and as quick as possible for the end users.

This is only being turned into FUD because it is now cool to hate Uber and everything they do now Must Be Evil.

Re: Permissions asked for by Uber Android app

#93
post #90

Earlier quoted context omitted.

Well I mean, is it actually causing any problems for Uber? Uber has what's pretty close to a monopoly in what it offers, apart from a few cities in the US where Lyft also operates. I would say most people that user Uber are not interested in using the regular local taxi service.

I spoke to a Lyft/Uber driver today in NCY. He said that Uber's losing drivers every day here — about 5% (I don't know where he got those numbers from). He also mentioned that Uber are flat out lying about how much drivers earn, and in some months drivers that aren't on Uber's "favourites" list end up owing Uber for renting the gear instead of earning money. This reputation is definitely damaging, and it's common kno…

I'm always very cautious of taking what opinion from HN (and others in 'tech') and extrapolating them out to the general population, so I read what you say (and my own opinion) with a grain of salt.

But like, Uber is in 230 cities around the world. Here in Australia I believe they added over 1000 new drivers over the past month. Here, Uber is the alternative. There is no Lyft or Sidecar - mainly because alternatives are too scared of legal action from government - ridesharing is essentially illegal here, but Uber plays the we're-waiting-for-the-law-to-catch-up card regardless.

Re: Permissions asked for by Uber Android app

#95
post #89

There's perfectly reasonable explanation for almost all of these permissions, and there's nothing in this analysis that suggests they're doing otherwise. The only one that I couldn't think of was WRITE_SETTINGS Permissions ACCESS_COARSE_LOCATION & ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET: They need to figure out if you have i…

Side note: Wouldn't it be good if Google required all apps to explain why each permission is necessary, similar to this?

It would also be good if users could install the app but without approving the full set of permissions. Developers would have to catch an exception, but it's worth it. (Supposedly with one of the recent Android releases this feature was planned and made it to some users but Google quickly reverted.)

Re: Permissions asked for by Uber Android app

#96

There's perfectly reasonable explanation for almost all of these permissions, and there's nothing in this analysis that suggests they're doing otherwise. The only one that I couldn't think of was WRITE_SETTINGS Permissions ACCESS_COARSE_LOCATION & ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET: They need to figure out if you have i…

You need READ_PHONE_STATE for the Android ID, so it is pretty common to include just to get a unique identifier for the device.

Re: Permissions asked for by Uber Android app

#97
post #89

Earlier quoted context omitted.

Side note: Wouldn't it be good if Google required all apps to explain why each permission is necessary, similar to this?

It would also be good if users could install the app but without approving the full set of permissions. Developers would have to catch an exception, but it's worth it. (Supposedly with one of the recent Android releases this feature was planned and made it to some users but Google quickly reverted.)

That's how Apple handles the iOS permission model, as I understand

Re: Permissions asked for by Uber Android app

#98
post #97

Earlier quoted context omitted.

It would also be good if users could install the app but without approving the full set of permissions. Developers would have to catch an exception, but it's worth it. (Supposedly with one of the recent Android releases this feature was planned and made it to some users but Google quickly reverted.)

That's how Apple handles the iOS permission model, as I understand

iOS really has 3 levels of access for things like this.

For the most sensitive things like location, contacts and photos, it prompts for user permission.

There's a lower category for things like background processing, you declare to Apple that you want to use them, and they are enabled by default. Some of them can be disabled by the user after the fact.

Then, there's things like internet usage which there is no permission system for.

Re: Permissions asked for by Uber Android app

#100
post #19
post #7

Earlier quoted context omitted.

Yeah I noticed that as well, it makes me wonder about the rest of his technical assertions that I'm less able to judge. Just in case anyone was wondering here's the HTTP 1.1 rfc: https://www.ietf.org/rfc/rfc2616.txt A simple search will show that it does include PUT and DELETE.

> "... it makes me wonder about the rest of his technical assertions that I'm less able to judge." What technical assertions? From what I can gather, he's just pointing out what he sees in the code and what he thinks it might be doing. None of that feels like technical assertions (apart from the statement about PUT and GET).

> what he thinks it might be doing.

don't be pedantic, this is obviously what they were referring to

Post reply on HN