Battery power alone can be used to track Android phones • Hacker News Board

It's not a p-value, it's Spearman's rho, or rank correlation coefficient. It's a value in [-1,1] and when deviating from zero indicates a statistically dependent relationship: http://en.wikipedia.org/wiki/Spearman%27s_rank_correlation_c...

Re: Battery power alone can be used to track Android phones

#46

Post by romaniv » Mon, Feb 23, 2015, 5:15 PM UTC

SifJar wrote: post #2

The article mentions that the required permissions are "very common permissions", and then in the next paragraph says that 179 apps on the Google Play store require those permissions. As of July 2014, there were 1.3 million apps in the app store [1]. That's ~0.014% of the apps on the store. Not exactly "very common" in my mind. Although the remark that they are "unlikely to raise suspicion" is valid, especially for t…

I am ver surprised there is still no mass outrage over Android permissions.

1. They are not properly named or explained. And no, this shouldn't be on some obscure website. This should be right there, in the menu that asks for them.

2. There is no way to filter apps in the play store by permissions. This isn't just a privacy thing. Apps that require the least permissions are often least bloated and the most skillfully written.

It's obvious that both of these thing are deliberate, it's obvious that this is an issue, and no one cares.

Re: Battery power alone can be used to track Android phones

#47

Post by hackuser » Mon, Feb 23, 2015, 5:19 PM UTC

wongarsu wrote: post #27

zipperhead wrote: post #19

Earlier quoted context omitted.

That's the problem with android. The 'typical user' has no control over individual app permission - it's literally all or none. If you install the app you give it access to the GPS, as long as it has specified that permission.

Rooted Cyanogenmod actually has privacy settings which enable you to restrict some permissions on a per-app basis. For example I don't allow Facebook Messenger access to GPS and Android asks me before Messenger gets camera access.

> Rooted Cyanogenmod actually has privacy settings which enable you to restrict some permissions on a per-app basis

Why only "some"; why not all?

Re: Battery power alone can be used to track Android phones

#48

Post by joenathan » Mon, Feb 23, 2015, 5:22 PM UTC

ttty wrote: post #9

jawns wrote: post #7

Earlier quoted context omitted.

This snippet (from the PDF) reveals the effectiveness of the technique: "To evaluate the first algorithm for distinguishing routes we recorded reference profiles for several different routes. We used a dataset of 43 profiles for 4 different routes about 19 kilometers each. Driving in different directions along the same roads (from point A to B vs. from point B to A) is considered two different routes. We perform a le…

But that if the battery discharges exactly the same. I think that is not the case, for example the battery when is at 50% might discharge (doing the exact thing) differently than when is at 20%. Maybe the battery is not well calibrated or the internal part of the battery are more wasted than others.

Additionally batteries degrade over their lifetime and will lose charge faster, also different phones have different wireless radios and different antenna configurations which would mean some phones would use more or less battery for the same operations.

Re: Battery power alone can be used to track Android phones

#49

Post by Sidnicious » Mon, Feb 23, 2015, 5:29 PM UTC

romaniv wrote: post #46

SifJar wrote: post #2

The article mentions that the required permissions are "very common permissions", and then in the next paragraph says that 179 apps on the Google Play store require those permissions. As of July 2014, there were 1.3 million apps in the app store [1]. That's ~0.014% of the apps on the store. Not exactly "very common" in my mind. Although the remark that they are "unlikely to raise suspicion" is valid, especially for t…

I am ver surprised there is still no mass outrage over Android permissions. 1. They are not properly named or explained. And no, this shouldn't be on some obscure website. This should be right there, in the menu that asks for them. 2. There is no way to filter apps in the play store by permissions. This isn't just a privacy thing. Apps that require the least permissions are often least bloated and the most skillfully…

Also, there's no way to download an app but deny it some permissions. iOS gets this right: apps don't get to ask for any permissions when you download them, they have to request them at runtime and the user can deny any of them (and the app is still expected to function)

Re: Battery power alone can be used to track Android phones

#50

Post by dagar » Mon, Feb 23, 2015, 5:29 PM UTC

zipperhead wrote: post #19

leereeves wrote: post #10

Earlier quoted context omitted.

The typical consumer would probably just give the app access to the GPS. The hard part is getting them to download it. Interesting research but not the most practical attack.

That's the problem with android. The 'typical user' has no control over individual app permission - it's literally all or none. If you install the app you give it access to the GPS, as long as it has specified that permission.

I honestly don't understand why this is a problem. Isn't it enough that the app says it requires my location when I install it? If you don't like the required permissions no one is forcing you to install it.