Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Permissions asked for by Uber Android app

gironsec.com

Post reply on HN
Print view View original

101–110 of 164 posts

Re: Permissions asked for by Uber Android app

#101

Post by baddox »

tonyhb wrote: post #90
madeofpalk wrote: post #27

Earlier quoted context omitted.

Well I mean, is it actually causing any problems for Uber? Uber has what's pretty close to a monopoly in what it offers, apart from a few cities in the US where Lyft also operates. I would say most people that user Uber are not interested in using the regular local taxi service.

I spoke to a Lyft/Uber driver today in NCY. He said that Uber's losing drivers every day here — about 5% (I don't know where he got those numbers from). He also mentioned that Uber are flat out lying about how much drivers earn, and in some months drivers that aren't on Uber's "favourites" list end up owing Uber for renting the gear instead of earning money. This reputation is definitely damaging, and it's common kno…

I'm sure the turnover for Uber is high. I would expect that for that type of job, regardless of the apparent ethical makeup of the company's executives.

Re: Permissions asked for by Uber Android app

#102

Post by baddox »

lsaferite wrote: post #85
andymcsherry wrote: post #34

There's perfectly reasonable explanation for almost all of these permissions, and there's nothing in this analysis that suggests they're doing otherwise. The only one that I couldn't think of was WRITE_SETTINGS Permissions ACCESS_COARSE_LOCATION & ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET: They need to figure out if you have i…

Can people really not be bothered to enter their CC number? Also, you can initiate the dialer without the CALL_PHONE permission, the user just has to hit the dial button.

Why are you bothered that other people might prefer to snap a picture of their credit card rather than type the numbers? I've used Uber's CC scanning on their iOS app, and it works really well.

Re: Permissions asked for by Uber Android app

#103

Post by baddox »

dmix wrote: post #81
blhack wrote: post #47

A LOT of this stuff is pretty easily explainable. They want access to SMS and phone calls because the Uber app uses those things. Camera doesn't seem terribly implausible. IT could be an incoming feature that allows you to take a photo of where you are so that your driver can find you more easily. The WiFi stuff is probably related to location. edit: as pointed out below, this is so that you can take a photo of your…

> I don't see the big OMG SECRET MALWARE scariness. This is the definition of malware: n. Malicious computer software that interferes with normal computer functions or sends personal data about the user to unauthorized parties over the Internet. I'm all for people taking responsibility for their privacy but this is basically what you are saying to people: "Hey you accepted that list of permissions (or Terms of Servic…

So then, how do you define "unauthorized parties"? All these permissions are explicitly authorized by the user, and I don't see any evidence that they're being used in unreasonable ways by Uber.

> The average person doesn't reasonably expect Uber to be mining this information about them.

Then it sounds like you would predict that, if you showed this article to the average Uber user, they would be upset and would stop using the app. Would you predict that? I think that is extremely unlikely, and that the vast majority of people wouldn't be interested and couldn't care less.

Re: Permissions asked for by Uber Android app

#104

Post by nic0lette »

lnanek2 wrote: post #96
andymcsherry wrote: post #34

There's perfectly reasonable explanation for almost all of these permissions, and there's nothing in this analysis that suggests they're doing otherwise. The only one that I couldn't think of was WRITE_SETTINGS Permissions ACCESS_COARSE_LOCATION & ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET: They need to figure out if you have i…

You need READ_PHONE_STATE for the Android ID, so it is pretty common to include just to get a unique identifier for the device.

No, you don't. Android ID is stored in Settings.Secure and can be read without any permission. READ_PHONE_STATE allows the app to read the IMEI/ESN/MEID of the device.

Re: Permissions asked for by Uber Android app

#105

Post by [deleted] »

lnanek2 wrote: post #96
andymcsherry wrote: post #34

There's perfectly reasonable explanation for almost all of these permissions, and there's nothing in this analysis that suggests they're doing otherwise. The only one that I couldn't think of was WRITE_SETTINGS Permissions ACCESS_COARSE_LOCATION & ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET: They need to figure out if you have i…

You need READ_PHONE_STATE for the Android ID, so it is pretty common to include just to get a unique identifier for the device.

[deleted]

Re: Permissions asked for by Uber Android app

#106

Post by dvhh »

TillE wrote: post #44
api wrote: post #31

Earlier quoted context omitted.

Sounds like classic poor security UX design -- it encourages people to allow everything, and encourages apps to claim everything.

I have a lot of issues with iOS, but I think Apple's UX here is clearly superior: it asks you about each individual permission an app requests (not on install, but when the permission is first used), and allows you to deny it.

Wasn't that almost the same approach with UAC ?

Re: Permissions asked for by Uber Android app

#108

Post by alec »

andymcsherry wrote: post #34

There's perfectly reasonable explanation for almost all of these permissions, and there's nothing in this analysis that suggests they're doing otherwise. The only one that I couldn't think of was WRITE_SETTINGS Permissions ACCESS_COARSE_LOCATION & ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET: They need to figure out if you have i…

> there's nothing in this analysis that suggests they're doing otherwise

The article included a decompiled code snippet showing it running methods like "sendMMSLog" and "sendPhoneCallLog", apparently logging a bunch of private data and sending it back to Uber.

Re: Permissions asked for by Uber Android app

#109

Post by makeramen »

Checking for root access is actually really useful from a developer standpoint. I've seen countless bugs on Crashlytics that are 100% on rooted devices which often is because the user has xposed or some other system level hacks that break my apps. This allows us developers to spend more time focusing on real bugs instead of chasing down these rooted device problems.

Re: Permissions asked for by Uber Android app

#110

Post by [deleted] »

revelation wrote: post #14
dmix wrote: post #5

TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…

Just for completeness sake and judging from the function names, this is the list, with attributes stored for each: - Accounts log (Email) - App Activity (Name, PackageName, Process Number of activity, Processed id) - App Data Usage (Cache size, code size, data size, name, package name) - App Install (installed at, name, package name, unknown sources enabled, version code, version name) - Battery (health, level, plugg…

[deleted]
Post reply on HN