Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android: I don't need your permission

blog.danlew.net

Post reply on HN
Print view View original

101–110 of 190 posts

Re: Android: I don't need your permission

#101

Post by MichaelGG »

jbk wrote: post #41

I wish it was that easy in all cases. For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service). The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work. But on the play store it's w…

It almost seems like they do it intentionally to improve tracking and desensitize users. Only a terrible engineer would think needing to know if the phone is ringing needs a permission, let alone one that provides unique IDs plus the phone numbers on phone calls.

It's one more reason I've gone from loving Google to actively avoiding them. (Also, they've very aggressive in getting people to turn on location info and history. They use dark UI patterns to trick people into activating stuff.)

Re: Android: I don't need your permission

#102

Post by icebraining »

iscrewyou wrote: post #95
jbk wrote: post #41

I wish it was that easy in all cases. For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service). The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work. But on the play store it's w…

This. This is why I am moving to iOS. I installed Pocket. It wanted permission Contacts and Calendar. Contacts, I understand for sharing purposes. Calendar? Yeah, fuck off. Maybe they are bundled together like "read phone status and identity" and Pocket has no way around it. Maybe it is not. As a user, I should not have to worry about that. Contact and Calendar in no way should be bundled together.

Maybe they are bundled together like "read phone status and identity" and Pocket has no way around it.

They aren't.

Re: Android: I don't need your permission

#103

Post by MichaelGG »

voltagex_ wrote: post #54
Ded7xSEoPKYNsDd wrote: post #34

Earlier quoted context omitted.

But then best practices say you should be doing cert pinning. That will block your CA. Although for most apps modifying that check to look for another cert is probably not too hard. (But of course if the app is obfuscated and does integrity checks on itself, it can get arbitrarily complicated.)

I visit sites with cert pinning at $EMPLOYER. $EMPLOYER runs a very expensive solution from Blue Coat which includes a MITM CA - no issues intercepting anything here. Amusingly, this meant the proxy itself was vulnerable to Heartblead while the client machines were not.

Browsers know this is s common downside to corp environments and excuse them if the proxy cert is installed. Arbitrary apps don't have to follow that.

Re: Android: I don't need your permission

#104

Post by gdrulia »

jbk wrote: post #41

I wish it was that easy in all cases. For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service). The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work. But on the play store it's w…

This has always baffled me, especially when phones doing their phone mission worse and worse over time. What I would really like is that all non-system applications would be pushed to hold pattern, similar as if application is not visible, except it would be applied to background services as well, so that all resources would be available to calling application. Maybe that would solve the lag I experience with every android phone when someone calls me and I try to pickup.

Re: Android: I don't need your permission

#105

Post by btgeekboy »

MichaelGG wrote: post #103
voltagex_ wrote: post #54

Earlier quoted context omitted.

I visit sites with cert pinning at $EMPLOYER. $EMPLOYER runs a very expensive solution from Blue Coat which includes a MITM CA - no issues intercepting anything here. Amusingly, this meant the proxy itself was vulnerable to Heartblead while the client machines were not.

Browsers know this is s common downside to corp environments and excuse them if the proxy cert is installed. Arbitrary apps don't have to follow that.

The only foolproof way to get around this is to hardcode the certificate into the application itself, or at least the intermediate chain. Otherwise, you could have always intercepted the first request and made that the certificate of record.

Re: Android: I don't need your permission

#106

Post by hrjet »

MichaelGG wrote: post #101
jbk wrote: post #41

I wish it was that easy in all cases. For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service). The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work. But on the play store it's w…

It almost seems like they do it intentionally to improve tracking and desensitize users. Only a terrible engineer would think needing to know if the phone is ringing needs a permission, let alone one that provides unique IDs plus the phone numbers on phone calls. It's one more reason I've gone from loving Google to actively avoiding them. (Also, they've very aggressive in getting people to turn on location info and h…

Adding to that: In Android Lollipop, One can't edit / delete local (phone-stored) contacts. They have to be synced to cloud in order to edit / delete them. If this is intentional, it is a sick dark UI pattern.

Re: Android: I don't need your permission

#107

Post by clumsysmurf »

In the case of bluetooth, you can either (1) request BLUETOOTH_ADMIN permission and enable BT yourself, or (2) ask Android to show an "Enable Bluetooth Dialog" (BluetoothAdapter.ACTION_REQUEST_ENABLE) which doesn't require that permission.

But #2 has been busted for a while https://code.google.com/p/android/issues/detail?id=60002

They didn't fix it, and marked it obsolete. So I guess we need BLUETOOTH_ADMIN after all.

Re: Android: I don't need your permission

#108

Post by schoen »

kijin wrote: post #91
M2Ys4U wrote: post #85

Earlier quoted context omitted.

Actually, you don't. You can use two different compilers that compile each other to prove that the compilation won't be tampered with. See https://www.schneier.com/blog/archives/2006/01/countering_tr...

What if both compilers are backdoored? It's not like you have a large choice of good compilers for any given language/platform pair.

Schneier's summary of Wheeler's method says: "This countermeasure will only fail if both [compilers] are infected in exactly the same way. The second compiler can be malicious; it just has to be malicious in some different way: i.e., it can't have the same triggers and payloads of the first. You can greatly increase the odds that the triggers/payloads are not identical by increasing diversity: using a compiler from a different era, on a different platform, without a common heritage, transforming the code, etc."

Re: Android: I don't need your permission

#109

Post by habosa »

Aldo_MX wrote: post #90
habosa wrote: post #83

There are two additions to the permissions API that I think would be very helpful: 1) Incremental Authorization - let Android apps ask for permissions only as they need them. So if you never use the phone dialing feature, they never ask for the permission. 2) One-time auth - allow an Android app to do something once. Say, scan your contacts one time. This gives you a little more control, so you know the dev isn't mon…

1) Incremental Authorization - let Android apps ask for permissions only as they need them. So if you never use the phone dialing feature, they never ask for the permission. Not only incremental authorization, but the ability of denying specific permissions.

Well with incremental the developer would put what is 'required' into the manifest for install-time prompt and incremental the rest.

You can't expect a developer to allow you to deny any permission, the whole app would be a giant if-statement spaghetti accounting for all of the permission combinations and workarounds.

Re: Android: I don't need your permission

#110

Post by [deleted] »

Someone1234 wrote: post #12

> If your app is closed-source then they have no way of verifying you're not downloading all their contacts to their servers. That's a common fallacy. Even if it is open source someone could still be doing that. In order to be secure you would have to: A) Download the source yourself B) Inspect the source C) Compile the source Just because you have the source doesn't mean what you get from the Play Store/Amazon App s…

[deleted]
Post reply on HN