Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Permissions asked for by Uber Android app

gironsec.com

Post reply on HN
Print view View original

131–140 of 164 posts

Re: Permissions asked for by Uber Android app

#131

Post by ulfw »

madeofpalk wrote: post #17
revelation wrote: post #14

Earlier quoted context omitted.

Just for completeness sake and judging from the function names, this is the list, with attributes stored for each: - Accounts log (Email) - App Activity (Name, PackageName, Process Number of activity, Processed id) - App Data Usage (Cache size, code size, data size, name, package name) - App Install (installed at, name, package name, unknown sources enabled, version code, version name) - Battery (health, level, plugg…

> I really don't see any reason for Google not to immediately remove this app Apart from Google being an investor in Uber?

That's a multihundredmillion reason to cut them some slack ;)

Re: Permissions asked for by Uber Android app

#133

Post by corobo »

wting wrote: post #86
dmix wrote: post #5

TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…

This is not something new. I've had LinkedIn and Facebook do this with my personal contacts. I use disposable emails for every site (www.spamgourmet.com). After installing LinkedIn and Facebook Android apps they started recommending adding old coworkers that I have 0 mutual friends / connections with.

It's not always them knowing your contact list. Sometimes (most times) this will be powered from the other side, as in someone you know has uploaded their contact list and it's matched you as you registered

Re: Permissions asked for by Uber Android app

#134

Post by andrewaylett »

rahimnathwani wrote: post #130
TheCoreh wrote: post #116

Earlier quoted context omitted.

Because of iOS's sandboxing, it's really hard for apps to get info outside of their own "container" of sorts, so it doesn't matter much if they can access the Internet. Keyboards from third parties are an obvious exception to this, so these require explicit permission to access the Internet.

> so it doesn't matter much if they can access the Internet Unless you have a limited cellular data allowance, or pay for data by actual usage. iOS allows you to disable cellular data for certain apps. It would be great if it could somehow figure out when I'm using a mi-fi when abroad, and treat that wifi access point as 'cellular'.

Android can be told to treat certain APs as limited usage, which means they're not used by apps that are set to WiFi only, or for which you've disabled mobile data.

Re: Permissions asked for by Uber Android app

#135

Post by Aissen »

andymcsherry wrote: post #34

There's perfectly reasonable explanation for almost all of these permissions, and there's nothing in this analysis that suggests they're doing otherwise. The only one that I couldn't think of was WRITE_SETTINGS Permissions ACCESS_COARSE_LOCATION & ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET: They need to figure out if you have i…

So, let me disagree with a few of those:

- CAMERA: there's an intent for that, you don't need the permission, although it will require tapping the "take a photo" and "ok" buttons

- CALL_PHONE: ditto, although it will require tapping the dial button.

- READ_CONTACTS: again, there's an intent for that, allowing you to select only the contacts you want to share with the app.

- READ_PHONE_STATE: either they want to be compatible with a very old version of Android, or they want to uniquely identify your phone, permanently. They might also want to know who you're calling or who's calling you in real time

Regarding MANAGE_ACCOUNTS, etc: some apps do that, and it seems to be all the rage. Unless you have multiple apps sharing a common account, I don't see the point. It's just leaks all your configured accounts on the device.

Re: Permissions asked for by Uber Android app

#136

Post by pja »

driverdan wrote: post #127
krschultz wrote: post #114

As an Android developer, I don't want to have to ask for as many permissions as I do. I have 1 button buried on 1 screen that allows you to call customer support. 99.9% of users never click the button. However, I have to make every single customer accept the CALL_PHONE permission. There are a bunch of permissions required for basics like autocompleting the users email for login, or checking the network state so you c…

Why? All we have is a tel: link that opens the phone number in the dialer. They can choose to initiate the call or not, no permissions needed.

A guess: The call might show up in the phone logs if it's made through the standard Android Phone app. If the call is made directly from the Uber App, then perhaps this means that Uber can hide the phone number from the user. I can think of a number of reasons why they'd want to do that if they could.

Re: Permissions asked for by Uber Android app

#137

Post by andygates »

JoshTriplett wrote: post #84
panarky wrote: post #54

Earlier quoted context omitted.

Even before this disclosure, the Uber app required a nauseatingly long list of permissions. I wiped an old Android phone, configured it with a dummy Gmail account, and then installed the Uber app there. So it's a dedicated Uber-only phone with no contacts, no personal data, powered off until I need a ride. It's a giant pain in the ass. Kinda happy to see this article, it validates my paranoia in some small way. Now t…

I don't use the Uber app at all; I use m.uber.com via Firefox Mobile, and it works just fine.

If Uber is such a bad actor, why are you people using it at all?

Re: Permissions asked for by Uber Android app

#138

Post by uptown »

dang wrote: post #69

We've attempted to change the baity title to something accurate and neutral, but if anyone can suggest a better title, please do.

Yeah, when I posted it, I realized the title wasn't ideal - but figured the safe bet was to adhere to the "post with the author's published title" rule.

Re: Permissions asked for by Uber Android app

#140

Post by charlieok »

jwegan wrote: post #111
mcav wrote: post #6

Earlier quoted context omitted.

PUT and DELETE are standardized. http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html

Furthermore, it looks like PUT & DELETE were never part of Webdav ( http://en.wikipedia.org/wiki/WebDAV ).

In that a WebDAV implementation wouldn't make use of them? I assumed that a WebDAV implemenation would use them, but the WebDAV spec doesn't need to define them because the HTTP spec it references already did...
Post reply on HN