Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Permissions asked for by Uber Android app

gironsec.com

Post reply on HN
Print view View original

111–120 of 164 posts

Re: Permissions asked for by Uber Android app

#111

Post by jwegan »

mcav wrote: post #6
andrewvc wrote: post #3

Recall that PUT / DELETE aren’t official HTTP requests, rather extensions implemented via WebDav. Modern applications don’t bother with these requests since its easier / more secure to perform those same actions with a server side language. Apparently the author has not ever heard of REST. I'm a little shocked by that.

PUT and DELETE are standardized. http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html

Furthermore, it looks like PUT & DELETE were never part of Webdav (http://en.wikipedia.org/wiki/WebDAV).

Re: Permissions asked for by Uber Android app

#112

Post by krschultz »

alec wrote: post #108
andymcsherry wrote: post #34

There's perfectly reasonable explanation for almost all of these permissions, and there's nothing in this analysis that suggests they're doing otherwise. The only one that I couldn't think of was WRITE_SETTINGS Permissions ACCESS_COARSE_LOCATION & ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET: They need to figure out if you have i…

> there's nothing in this analysis that suggests they're doing otherwise The article included a decompiled code snippet showing it running methods like "sendMMSLog" and "sendPhoneCallLog", apparently logging a bunch of private data and sending it back to Uber.

The method is named sendMMSLog. The body of the method is not shown. Is it logging the messages sent to & from Uber? Or the messages you sent to your girlfriend. The difference between those two is massive.

Re: Permissions asked for by Uber Android app

#113

Post by jpatokal »

alec wrote: post #108
andymcsherry wrote: post #34

There's perfectly reasonable explanation for almost all of these permissions, and there's nothing in this analysis that suggests they're doing otherwise. The only one that I couldn't think of was WRITE_SETTINGS Permissions ACCESS_COARSE_LOCATION & ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET: They need to figure out if you have i…

> there's nothing in this analysis that suggests they're doing otherwise The article included a decompiled code snippet showing it running methods like "sendMMSLog" and "sendPhoneCallLog", apparently logging a bunch of private data and sending it back to Uber.

No, it shows that there exists a method that calls a bunch of methods. However, as others have explained these methods appear to be from a library that's been loaded in wholesales, and it doesn't show that the method is ever called or that any data is ever transmitted.

Re: Permissions asked for by Uber Android app

#114

Post by krschultz »

As an Android developer, I don't want to have to ask for as many permissions as I do. I have 1 button buried on 1 screen that allows you to call customer support. 99.9% of users never click the button. However, I have to make every single customer accept the CALL_PHONE permission.

There are a bunch of permissions required for basics like autocompleting the users email for login, or checking the network state so you can adjust the app behavior based on connectivity.

Not to mention the incentives are all wrong in the Play store. Changing permissions murders your update rate, so you want to do it as little as possible. So when you are forced to add a permission, you grab a bunch of extra ones you 'plan' to use later to avoid having to get over that hump again. It's really awful.

Re: Permissions asked for by Uber Android app

#115

Post by [deleted] »

nhayden wrote: post #57
revelation wrote: post #14

Earlier quoted context omitted.

Just for completeness sake and judging from the function names, this is the list, with attributes stored for each: - Accounts log (Email) - App Activity (Name, PackageName, Process Number of activity, Processed id) - App Data Usage (Cache size, code size, data size, name, package name) - App Install (installed at, name, package name, unknown sources enabled, version code, version name) - Battery (health, level, plugg…

A lot of apps collect this information. There are flashlight apps that collect the same level. This is nothing new.

[deleted]

Re: Permissions asked for by Uber Android app

#116

Post by TheCoreh »

andymcsherry wrote: post #98
twrkit wrote: post #97

Earlier quoted context omitted.

That's how Apple handles the iOS permission model, as I understand

iOS really has 3 levels of access for things like this. For the most sensitive things like location, contacts and photos, it prompts for user permission. There's a lower category for things like background processing, you declare to Apple that you want to use them, and they are enabled by default. Some of them can be disabled by the user after the fact. Then, there's things like internet usage which there is no permi…

Because of iOS's sandboxing, it's really hard for apps to get info outside of their own "container" of sorts, so it doesn't matter much if they can access the Internet. Keyboards from third parties are an obvious exception to this, so these require explicit permission to access the Internet.

Re: Permissions asked for by Uber Android app

#118

Post by api »

dvhh wrote: post #106
TillE wrote: post #44

Earlier quoted context omitted.

I have a lot of issues with iOS, but I think Apple's UX here is clearly superior: it asks you about each individual permission an app requests (not on install, but when the permission is first used), and allows you to deny it.

Wasn't that almost the same approach with UAC ?

UAC overdid it.
Post reply on HN