Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Permissions asked for by Uber Android app

gironsec.com

Post reply on HN
Print view View original

151–160 of 164 posts

Re: Permissions asked for by Uber Android app

#151

Post by tadfisher »

Aissen wrote: post #135
andymcsherry wrote: post #34

There's perfectly reasonable explanation for almost all of these permissions, and there's nothing in this analysis that suggests they're doing otherwise. The only one that I couldn't think of was WRITE_SETTINGS Permissions ACCESS_COARSE_LOCATION & ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET: They need to figure out if you have i…

So, let me disagree with a few of those: - CAMERA: there's an intent for that, you don't need the permission, although it will require tapping the "take a photo" and "ok" buttons - CALL_PHONE: ditto, although it will require tapping the dial button. - READ_CONTACTS: again, there's an intent for that, allowing you to select only the contacts you want to share with the app. - READ_PHONE_STATE: either they want to be co…

Having implemented the first three: various manufacturers release dialer and contact apps that do not implement the Intent in the same way as the AOSP/Google apps. For example, the HTC Sense contacts application does not grant you the single-record permission when you select a contact via the ACTION_PICK_CONTACT intent, so your app will generate a permission error and you will not get the contact data without READ_CONTACTS.

Similar issues abound with the myriad of camera applications.

Re: Permissions asked for by Uber Android app

#152

Post by andymcsherry »

Aissen wrote: post #135
andymcsherry wrote: post #34

There's perfectly reasonable explanation for almost all of these permissions, and there's nothing in this analysis that suggests they're doing otherwise. The only one that I couldn't think of was WRITE_SETTINGS Permissions ACCESS_COARSE_LOCATION & ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET: They need to figure out if you have i…

So, let me disagree with a few of those: - CAMERA: there's an intent for that, you don't need the permission, although it will require tapping the "take a photo" and "ok" buttons - CALL_PHONE: ditto, although it will require tapping the dial button. - READ_CONTACTS: again, there's an intent for that, allowing you to select only the contacts you want to share with the app. - READ_PHONE_STATE: either they want to be co…

You can't use sync adapters without using account manager. That's the primary reason for it, not for sharing credentials between apps.

Re: Permissions asked for by Uber Android app

#153

Post by MrGunn »

makeramen wrote: post #109

Checking for root access is actually really useful from a developer standpoint. I've seen countless bugs on Crashlytics that are 100% on rooted devices which often is because the user has xposed or some other system level hacks that break my apps. This allows us developers to spend more time focusing on real bugs instead of chasing down these rooted device problems.

It's not a user's fault they have to root to regain some control over a piece of hardware they own. Your app shouldn't crash under xposed - test for it.

Re: Permissions asked for by Uber Android app

#155

Post by robomc »

panarky wrote: post #54
dmix wrote: post #5

TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…

Even before this disclosure, the Uber app required a nauseatingly long list of permissions. I wiped an old Android phone, configured it with a dummy Gmail account, and then installed the Uber app there. So it's a dedicated Uber-only phone with no contacts, no personal data, powered off until I need a ride. It's a giant pain in the ass. Kinda happy to see this article, it validates my paranoia in some small way. Now t…

Why not just.... not use Uber?

That seems like a massively inconvenient workaround to use a service which really only offers a mild convenience (over, say, a regular taxi).

Re: Permissions asked for by Uber Android app

#156

Post by archon810 »

andymcsherry wrote: post #34

There's perfectly reasonable explanation for almost all of these permissions, and there's nothing in this analysis that suggests they're doing otherwise. The only one that I couldn't think of was WRITE_SETTINGS Permissions ACCESS_COARSE_LOCATION & ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET: They need to figure out if you have i…

According to Uber, WRITE_SETTINGS is used for "We use this permission to save data and cache mapping vectors, which helps power our app in 45+ countries and make Uber the world's most reliable ride."

https://m.uber.com/android-permissions

Re: Permissions asked for by Uber Android app

#157

Post by lsaferite »

baddox wrote: post #102
lsaferite wrote: post #85

Earlier quoted context omitted.

Can people really not be bothered to enter their CC number? Also, you can initiate the dialer without the CALL_PHONE permission, the user just has to hit the dial button.

Why are you bothered that other people might prefer to snap a picture of their credit card rather than type the numbers? I've used Uber's CC scanning on their iOS app, and it works really well.

Because, with Android's silly all or nothing permissions, it means the Uber app want access to my camera which it doesn't really need.

Re: Permissions asked for by Uber Android app

#158

Post by Aissen »

andymcsherry wrote: post #152
Aissen wrote: post #135

Earlier quoted context omitted.

So, let me disagree with a few of those: - CAMERA: there's an intent for that, you don't need the permission, although it will require tapping the "take a photo" and "ok" buttons - CALL_PHONE: ditto, although it will require tapping the dial button. - READ_CONTACTS: again, there's an intent for that, allowing you to select only the contacts you want to share with the app. - READ_PHONE_STATE: either they want to be co…

You can't use sync adapters without using account manager. That's the primary reason for it, not for sharing credentials between apps.

Hum, are you sure you can't do without ? If not, it's quite a mistake of Google's part.

Re: Permissions asked for by Uber Android app

#159

Post by Aissen »

tadfisher wrote: post #151
Aissen wrote: post #135

Earlier quoted context omitted.

So, let me disagree with a few of those: - CAMERA: there's an intent for that, you don't need the permission, although it will require tapping the "take a photo" and "ok" buttons - CALL_PHONE: ditto, although it will require tapping the dial button. - READ_CONTACTS: again, there's an intent for that, allowing you to select only the contacts you want to share with the app. - READ_PHONE_STATE: either they want to be co…

Having implemented the first three: various manufacturers release dialer and contact apps that do not implement the Intent in the same way as the AOSP/Google apps. For example, the HTC Sense contacts application does not grant you the single-record permission when you select a contact via the ACTION_PICK_CONTACT intent, so your app will generate a permission error and you will not get the contact data without READ_CO…

Interesting, how recent are those HTC Sense phones? Any pointers to such bugs? I agree it's a shame that it isn't implemented properly. It should be part of CTS.

Re: Permissions asked for by Uber Android app

#160

Post by MetaCosm »

robomc wrote: post #155
panarky wrote: post #54

Earlier quoted context omitted.

Even before this disclosure, the Uber app required a nauseatingly long list of permissions. I wiped an old Android phone, configured it with a dummy Gmail account, and then installed the Uber app there. So it's a dedicated Uber-only phone with no contacts, no personal data, powered off until I need a ride. It's a giant pain in the ass. Kinda happy to see this article, it validates my paranoia in some small way. Now t…

Why not just.... not use Uber? That seems like a massively inconvenient workaround to use a service which really only offers a mild convenience (over, say, a regular taxi).

You must live in an area with good to great taxi service.

There are areas where taxi service is so spotty as to be scary, were simply getting a cab is a huge pain (IE: called and ordered) and flagging one down is a non-starter. Even after calling in a cab, they often end up being no-shows (get a better fare en-route, etc)... it is scary when you can't get dependable public transit home from a location (stuck alone, outside, waiting for sometimes hours).

Uber started and initially flourished in areas were taxi service was insanely poor due to bad regulation and/or corruption. Uber was basically a response to the godawful taxi situation in SF.

I know I feel far more comfortable when the people I care about are able to get an Uber/Lyft/(similar) service.

Post reply on HN