Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android: I don't need your permission

blog.danlew.net

Post reply on HN
Print view View original

31–40 of 190 posts

Re: Android: I don't need your permission

#31

Post by JohnTHaller »

Someone1234 wrote: post #12

> If your app is closed-source then they have no way of verifying you're not downloading all their contacts to their servers. That's a common fallacy. Even if it is open source someone could still be doing that. In order to be secure you would have to: A) Download the source yourself B) Inspect the source C) Compile the source Just because you have the source doesn't mean what you get from the Play Store/Amazon App s…

Except that it is possible to have lots of someones reliably do A through C with a defined environment and get the exact same output every time they compile it. It's referred to as 'deterministic' builds. Bitcoin and Tor are doing it, for example.

Most of the people that dismiss the security advantages of open source either don't understand them or are trying to sell you some closed source code.

Re: Android: I don't need your permission

#32

Post by lucas-be »

sharjeel wrote: post #29
lucas-be wrote: post #25

Earlier quoted context omitted.

So the entire computer world had run like this for decade. why are people complaining about that now? Because Apple is doing strict verification of your code behaviour? Yesterday adobe pdf viewer tell me that an update was available both on my mac and pc! So without asking my permission, this computer application (and many others) are querying the web...

The PCs didn't sit in your pocket all data with sensing GPS location, mic, camera, footsteps, discovery of bluetooth and wifi devices around you; neither were they single point of communication with the rest of the world.

Not as long as you have not synchronized your phone with a cloud service (ICloud, Google drive, etc.) on which your PC/MAC is connect too.

Re: Android: I don't need your permission

#33

Post by a1369209993 »

tormeh wrote: post #16
foo2312 wrote: post #14

Earlier quoted context omitted.

It may seem a bit silly to add this, but I think it is good to link the reference for those who may not have seen it before: Even compiling from source, one also has to trust the compiler... (see, e.g. the classic http://cm.bell-labs.com/who/ken/trust.html , pdf version at https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp... )

And then you have to trust the OS. And the machine... Unless you build you computer yourself from silicon, you're not going to get rid of trust.

> Unless you build you computer yourself from silicon

And the chip design, and the fab control software, and the tools that make the tools that make the tools. And descrete components won't help you because transistors are large enough to conceal a mircocontroler emulating a transistor and listening for high-frequency handshake signals.

Relays are probably safe since you can make those yourself out of iron and copper (rods, springs and wire), and conveniently those are the same things you need to build motors!

You're still probably screwed though.

Re: Android: I don't need your permission

#34

Post by Ded7xSEoPKYNsDd »

joshfraser wrote: post #26
Someone wrote: post #23

Earlier quoted context omitted.

And if you can't make head or tails of it, you may conclude "good, it seems encrypted. Unfortunately, that means I cannot tell what they send to their server".

I assume you'd set up a custom CA on your proxy so you can spy on the https traffic. I'd be suspicious if I saw large blogs of data that had been encrypted in the application instead of at the network layer.

But then best practices say you should be doing cert pinning. That will block your CA.

Although for most apps modifying that check to look for another cert is probably not too hard. (But of course if the app is obfuscated and does integrity checks on itself, it can get arbitrarily complicated.)

Re: Android: I don't need your permission

#35

Post by avz »

I would be very happy if instead of preventing me from installing apps which require a given permission, Android would let me install them at my own risk in a sandbox which provides the app with dummy data and interactions (whether from a sensor, contacts db, camera etc).

It would be even better if the framework explicitly supported running apps without the necessary permissions and simply threw some sort of PermissionException. This would cripple some functionality while preserving the rest.

Developers could of course write the apps to not work under such reduced conditions, but Google Play could reject such apps.

Re: Android: I don't need your permission

#36

Post by john61 »

avz wrote: post #28
mrpdaemon wrote: post #18

Earlier quoted context omitted.

The chain of trust doesn't quite stop at compiling the source, in order to be really sure that nothing unintended is going on you have to compile the compiler yourself. At the end of the day you will have to trust some bootstrapping binary compiler unless you put it together yourself in machine language.

Good point. Given sufficient paranoia this train of suspicion can be continued even deeper down the rabbit hole: you'd need to inspect the hardware designs and make sure the hardware you've got was actually produced according to the inspected designs. In technology as elsewhere, it seems life is ultimately based on trust in someone.

> In technology as elsewhere, it seems life is ultimately based on trust in someone.

trust is a function of control. With free software it is distributed trust and control. With proprietary Sw it is centralized trust and control.

Real life proved that centralized control is a bad idea, that is why we invented democracy and free software.

Re: Android: I don't need your permission

#37

Post by nly »

Someone1234 wrote: post #12

> If your app is closed-source then they have no way of verifying you're not downloading all their contacts to their servers. That's a common fallacy. Even if it is open source someone could still be doing that. In order to be secure you would have to: A) Download the source yourself B) Inspect the source C) Compile the source Just because you have the source doesn't mean what you get from the Play Store/Amazon App s…

In practice you can disassemble Java apps to pseudo source code anyway. I've done it several times to APKs to see what is going on under the covers. Deliberate obfuscation would be immediately suspicious.

Re: Android: I don't need your permission

#38

Post by Pxtl »

Fradow wrote: post #11

The theory seems great. The reality is not. When you do that, you delegate your UX and proper functionning of your app to a third-party app. The UX can vary according the app. One thing is certain, it won't always be consistent with your app. It is also going to be more complicated for the user (more actions to make, more choices, just because you don't want to add permissions). The proper functionning is even worse.…

Thinking like this is what led to so many terrible '90s windows apps eschewing the Common Dialog box for file management.

We all eventually accepted that you should let the OS do its native thing. Android is no different.

Re: Android: I don't need your permission

#39

Post by avar »

avz wrote: post #30
zak_mc_kracken wrote: post #24

Earlier quoted context omitted.

And of course, you can always see if an app is uploading your contact data to their servers, even if that app is closed source.

Anyone could use a network sniffer to see it is uploading something , but you can't tell what since the content may be encrypted. Advanced user may be able to follow the data in a debugger, but that's a lot of work. Very advanced user could instrument the code to perform data flow analysis, see https://www.cs.cmu.edu/~wklieber/papers/soap2014-didfail.pdf

You can relatively easily MITM most applications by uploading a custom root certificate to your phone, and doing SSL termination + re-establishment on a router your phone is using.

Re: Android: I don't need your permission

#40

Post by matkam »

avz wrote: post #35

I would be very happy if instead of preventing me from installing apps which require a given permission, Android would let me install them at my own risk in a sandbox which provides the app with dummy data and interactions (whether from a sensor, contacts db, camera etc). It would be even better if the framework explicitly supported running apps without the necessary permissions and simply threw some sort of Permissi…

Android had a hidden feature in certain iterations of Android 4, called "App Ops," that would let you do this but it never made it to prime time. Though Cyanogenmod does leverage it for their "Privacy Guard" feature.
Post reply on HN