Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android: I don't need your permission

blog.danlew.net

Post reply on HN
Print view View original

171–180 of 190 posts

Re: Android: I don't need your permission

#171

Post by tripzilch »

masklinn wrote: post #154
tripzilch wrote: post #146

Earlier quoted context omitted.

I' an Android (Cyanogenmod) user and agree with your point, this could--and should--be done a lot better. I am not familiar with iOS and iPhones at all. You state iOS apps only rarely need to be granted permissions, how do they make that work? I can see only three ways that could happen: Either the app can do most things without asking permissions (bad for the user--there'd be malware). Or the app simply can't ask fo…

> I could be wrong but I'm guessing it's the third option? Nah, it's a combination of two things: 1. Applications are granted internet access by default. It's possible to disable cellular access on a per-application basis, but not networking in general 2. Permissions are asked for at point of use with a big allow/deny dialog. This has several consequences * it's easier for the user to understand why the application w…

Thanks, that makes sense. Better option than what Android does too, IMO.

Especially if the permissions are also more granular than they are on Android. Otherwise I could imagine an evil app prompting a type of permission in the context of something completely innocuous and reasonable (say, to pre-fill contact data to some input field), only to use that very same permission immediately afterwards for something evil (sending all contacts data to their servers).

Re: Android: I don't need your permission

#172

Post by kuschku »

acdha wrote: post #46
nly wrote: post #37

Earlier quoted context omitted.

In practice you can disassemble Java apps to pseudo source code anyway. I've done it several times to APKs to see what is going on under the covers. Deliberate obfuscation would be immediately suspicious.

1. How closely would you have to look to notice something like a weak crypto setup or other “accidental” change less obvious than sending everything to “all-your-bytes.nsa.gov”? 2. How many people other than blackhats actually have the time to do this for every single automatic update?

It’s actually really easy.

I tried understanding the APIs several phone apps are using, (the apps are heavily obfuscated), so I decompiled them and hacked my own small deobfuscater where I could rename stuff half-automatically.

Then I went through the code of Google Apps with this, and it’s actually really nice. Although kinda surprising how many Google Apps have hardcoded API keys for their services floating around, for example there is one Google App which has a hardcoded key that allows full unthrottled API access to all of the Google Maps APIs. For free.

I just did this out of fun, as I’m mostly working on Android OpenSource apps, but it was quite easy and interesting to see how Google obfuscates their apps.

Re: Android: I don't need your permission

#173

Post by dllthomas »

MichaelGG wrote: post #159
dllthomas wrote: post #100

Earlier quoted context omitted.

"Knowing the phone is ringing or off the hook should not be privileged information." It seems like it could be a privacy concern. It seems a common enough need that it probably shouldn't be lumped together with other things, though.

Could you elaborate how it's a privacy concern? I have to get pretty darn creative to come up with any scenarios.

What makes a privacy concern legitimate, to your mind? It's giving data about a person to a group that otherwise would not have had access to it. It seems first order a privacy concern.

There's also some possibility it could be turned into more sensitive data - if my app tends to be recommended around social circles, and I see two people were on the phone over the same period of time, it's likely they were talking.

Re: Android: I don't need your permission

#174

Post by untog »

dmix wrote: post #74
dozy wrote: post #13

Earlier quoted context omitted.

I love CyanogenMod (or at least the concept...I'm over dealing with the headache in practice), but the reason I used it was certainly not for improved stability and security. Not that I particularly trust OEMs/carriers, but the only way I'd feel more secure with CyanogenMod is if I had time to audit the source and build the kernel and OS binaries myself, and that includes whatever code is used to root and unlock your…

Privacy Guard does not require rooting your phone and can easily be enabled in stock ASOP Android phones: http://www.guidingtech.com/23409/enable-android-permissions-... It is really a shame that Android doesn't provide this feature enabled by default anymore (as they did for at one point). It could easily be provided with a warning that this might break your apps and use with caution. Security often has a UX trade-o…

Unfortunately you do need root as of 4.4, IIRC.

Re: Android: I don't need your permission

#175

Post by acdha »

kuschku wrote: post #172
acdha wrote: post #46

Earlier quoted context omitted.

1. How closely would you have to look to notice something like a weak crypto setup or other “accidental” change less obvious than sending everything to “all-your-bytes.nsa.gov”? 2. How many people other than blackhats actually have the time to do this for every single automatic update?

It’s actually really easy. I tried understanding the APIs several phone apps are using, (the apps are heavily obfuscated), so I decompiled them and hacked my own small deobfuscater where I could rename stuff half-automatically. Then I went through the code of Google Apps with this, and it’s actually really nice. Although kinda surprising how many Google Apps have hardcoded API keys for their services floating around,…

Finding predictable things like hard-coded strings is a significantly easier task than proving that none of the code is doing something sneaky. It's much easier to look for something like an access key than confirm that the numeric constants being passed to a crypto function are the correct ones or that it's not leaking something which would make it much easier to crack.

Re: Android: I don't need your permission

#176

Post by MichaelGG »

dllthomas wrote: post #173
MichaelGG wrote: post #159

Earlier quoted context omitted.

Could you elaborate how it's a privacy concern? I have to get pretty darn creative to come up with any scenarios.

What makes a privacy concern legitimate, to your mind? It's giving data about a person to a group that otherwise would not have had access to it. It seems first order a privacy concern. There's also some possibility it could be turned into more sensitive data - if my app tends to be recommended around social circles, and I see two people were on the phone over the same period of time, it's likely they were talking.

And if a service can reach out to the Internet, it knows my IP can tell where I am. And if it suddenly cuts out after being on a known IP, then maybe I'm going through a local tunnel.

That's what I meant by you have to get really creative to think how this could possibly be impacting. If you have a sandbox, you have to choose which permissions you're going to ask for carefully, to avoid overloading users.

Android made a bad decision by making phone apps needing permission to know if the phone is active, then compounded that by tying it into device ID and who you're calling.

Re: Android: I don't need your permission

#177

Post by gpvos »

hrktb wrote: post #117
hrjet wrote: post #106

Earlier quoted context omitted.

Adding to that: In Android Lollipop, One can't edit / delete local (phone-stored) contacts. They have to be synced to cloud in order to edit / delete them. If this is intentional, it is a sick dark UI pattern.

On one hand it's backwards from the user experience POV. On the other hand it garantees consistency and resolves most of the weird edge cases of contacts syncing. I think the common wisdom would be to put the burden on the engineers to find a solution that somewhat handles all the quircks. Personally I've had so many sync failure and weird behaviors from all the services tried until now that I would settle for a more…

Good to know, so I won't update to Lollipop.

I have no desire to use syncing, so I would be stuck without an essential feature, in order for them to fix edge cases in something that I don't need.

Re: Android: I don't need your permission

#178

Post by kuschku »

acdha wrote: post #175
kuschku wrote: post #172

Earlier quoted context omitted.

It’s actually really easy. I tried understanding the APIs several phone apps are using, (the apps are heavily obfuscated), so I decompiled them and hacked my own small deobfuscater where I could rename stuff half-automatically. Then I went through the code of Google Apps with this, and it’s actually really nice. Although kinda surprising how many Google Apps have hardcoded API keys for their services floating around,…

Finding predictable things like hard-coded strings is a significantly easier task than proving that none of the code is doing something sneaky. It's much easier to look for something like an access key than confirm that the numeric constants being passed to a crypto function are the correct ones or that it's not leaking something which would make it much easier to crack.

We’re not talking about hardcoded strings, lol.

This is encryption and obfuscation on multiple levels, classes passing each others state through hashing and encryption schemes on multiple levels, added bytecode hackery, etc.

Re: Android: I don't need your permission

#179

Post by hellbanner »

iscrewyou wrote: post #95
jbk wrote: post #41

I wish it was that easy in all cases. For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service). The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work. But on the play store it's w…

This. This is why I am moving to iOS. I installed Pocket. It wanted permission Contacts and Calendar. Contacts, I understand for sharing purposes. Calendar? Yeah, fuck off. Maybe they are bundled together like "read phone status and identity" and Pocket has no way around it. Maybe it is not. As a user, I should not have to worry about that. Contact and Calendar in no way should be bundled together.

There's still no way to pick and choose on Android is there?

Re: Android: I don't need your permission

#180

Post by mcherm »

blueskin_ wrote: post #141

This is why I love xprivacy. It gives me a popup when an app tries to access something, and I can whitelist or blacklist it, either on a temporary or permanent basis. Unlike google's halfarsed attempt at a privacy layer, it also doesn't give an exception when an app tries to access restricted data as that can cause apps to crash; it just sends back fake data (device ID is DEFACE, contacts are empty, location is chris…

> Stop trying to do intrusive things like prefilling forms, as it doesn't benefit the user in any real way.

Speak for yourself -- I find prefilled forms to be a time-saver.

However, I don't want apps trying to read through my contacts in order to do it. What I want (but haven't actually configured) is xprivacy configured to make contacts appear empty.

Post reply on HN