Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1k Android apps harvest data even after you deny permissions

cnet.com

Post reply on HN
Print view View original

11–20 of 146 posts

Re: More than 1k Android apps harvest data even after you deny permissions

#11

Post by newscracker »

> Egelman said the researchers notified Google about these issues last September, as well as the FTC. Google said it would be addressing the issues in Android Q, which is expected to release this year.

A whole year to get a solution out?! Google is clearly demonstrating where it stands when it concerns privacy.

With the usual low penetration of the latest release of Android, this will probably be “solved” for the majority of the devices in four years from now. Sigh!

Edit: Why not crack down on apps through updates to the Play Store policies and rules? Apple seems to use that tactic sometimes.

Re: More than 1k Android apps harvest data even after you deny permissions

#12

Post by doc_gunthrop »

sschueller wrote: post #3
rkachowski wrote: post #2

By what set of mechanisms is it possible for the app to access data that you've denied the app access to? It seems the flaw is in Android allowing this to happen. The example given (app accessing photo with embedded gps coords) seems very specific and doesn't deal with the general notion of data harvesting. And wrt mac address lookups - for this reason it's not possible to list the available wifi access points on and…

Android does not ask for permission to read certain things like the clipboard. So an app can intercept anything added to the clipboard such as passwords copied in by password managers.

If you use Lineage OS (or its predecessor, CyanogenMod, both of which are Android forks) you are, ostensibly, given the ability to permit or deny access to read from and/or write to the clipboard via the included permissions manager, Privacy Guard.

Re: More than 1k Android apps harvest data even after you deny permissions

#13

Post by [deleted] »

BryantD wrote: post #10
rkachowski wrote: post #2

By what set of mechanisms is it possible for the app to access data that you've denied the app access to? It seems the flaw is in Android allowing this to happen. The example given (app accessing photo with embedded gps coords) seems very specific and doesn't deal with the general notion of data harvesting. And wrt mac address lookups - for this reason it's not possible to list the available wifi access points on and…

There's a paper linked from the article which contains details on the sidechannels: https://www.ftc.gov/system/files/documents/public_events/141... Example: if you have an SD card installed, one advertising SDK creates a file on it. When the SDK is running in an app with appropriate permissions, it writes the IMEI and advertising ID to that file. When it's running in an app without appropriate permissions, it retriev…

[deleted]

Re: More than 1k Android apps harvest data even after you deny permissions

#15

Post by [deleted] »

sschueller wrote: post #3
rkachowski wrote: post #2

By what set of mechanisms is it possible for the app to access data that you've denied the app access to? It seems the flaw is in Android allowing this to happen. The example given (app accessing photo with embedded gps coords) seems very specific and doesn't deal with the general notion of data harvesting. And wrt mac address lookups - for this reason it's not possible to list the available wifi access points on and…

Android does not ask for permission to read certain things like the clipboard. So an app can intercept anything added to the clipboard such as passwords copied in by password managers.

[deleted]

Re: More than 1k Android apps harvest data even after you deny permissions

#16

Post by panpanna »

wartijn_ wrote: post #9
panpanna wrote: post #5

> The update will address the issue by hiding location information in photos from apps and requiring any apps that access Wi-Fi to also have permission for location data, according to Google. The great minds at Google have done it again!! This craziness (Bluetooth requires location) was the reason I never bought a smartwatch. I guess now I should stop using internet too.

According to Google Bluetooth requires location, because it van be used to find your location. So there is some reasoning behind this decisions, although I wwould be mutch happier with something like: Location (Bluetooth), location (GPS), location (WiFi) >A location permission is required because Bluetooth scans can be used to gather information about the location of the user. This information may come from the user'…

Please take a step back and look at this again.

What is the cause and what is the effect here? Is Google's solution making it better or worse from a practical privacy point of view?

(Also, don't buy Google's explanation that this is just to inform users of potential misuse - they actually log your location and even wait for a GPS lock when you pair a new device)

Re: More than 1k Android apps harvest data even after you deny permissions

#17

Post by HillaryBriss »

wartijn_ wrote: post #4
rkachowski wrote: post #2

By what set of mechanisms is it possible for the app to access data that you've denied the app access to? It seems the flaw is in Android allowing this to happen. The example given (app accessing photo with embedded gps coords) seems very specific and doesn't deal with the general notion of data harvesting. And wrt mac address lookups - for this reason it's not possible to list the available wifi access points on and…

From the article: > The 1,325 apps that violated permissions on Android used workarounds hidden in its code that would take personal data from sources like Wi-Fi connections and metadata stored in photos. > Researchers found that Shutterfly, a photo-editing app, had been gathering GPS coordinates from photos and sending that data to its own servers, even when users declined to give the app permission to access locati…

> So basically, they can't read your location, but they can read other things that contain your (previous) location

Yes, and I think we could make a good case that the Android platform did a poor job of clarifying this to the user. I would guess that the typical android user thinks "location permission" means location data of any type as generated by any subsystem on the device.

To whom would a reasonable user assign responsibility for this protection failure -- app developers or the Android platform?

Re: More than 1k Android apps harvest data even after you deny permissions

#18

Post by hedora »

DoofusOfDeath wrote: post #14

Would any/all of these methods be violations of U.S. criminal laws against unauthorized computer access? They seem to contravene the computer owner's explicit choices about allowed access.

I think this behavior is covered by existing criminal law. If not, the law needs to be updated.

Replace “phone“ with “web server”, and you will find legal precedents showing that much of the behavior is criminal.

In particular, it is clearly not legal to walk the file system tree to obtain access to private data you were explicitly denied access to, and then directly profit from the data you illegally harvested.

Failing to strip exif location data, even though gps access was denied? That’s a gray area, at worst.

(I am not a lawyer.)

Re: More than 1k Android apps harvest data even after you deny permissions

#19

Post by HillaryBriss »

The Android platform and Play Store place too much trust in the integrity of app developers who are forced to occupy an intentionally low-profitability app ecosystem. Google will never expend the effort to filter out all of the malware. It's too expensive. Google is too inefficient and the dev teams are too loosely managed.

Re: More than 1k Android apps harvest data even after you deny permissions

#20

Post by imtyler »

sschueller wrote: post #3
rkachowski wrote: post #2

By what set of mechanisms is it possible for the app to access data that you've denied the app access to? It seems the flaw is in Android allowing this to happen. The example given (app accessing photo with embedded gps coords) seems very specific and doesn't deal with the general notion of data harvesting. And wrt mac address lookups - for this reason it's not possible to list the available wifi access points on and…

Android does not ask for permission to read certain things like the clipboard. So an app can intercept anything added to the clipboard such as passwords copied in by password managers.

Wow. The password manager I've been using for the past few years has dedicated buttons/gestures for copying the password to the clipboard (like many others, I'd assumed.)

I feel like the expectations in this case are clear: a copied password should only accessible when the user "pastes" it. (The app even clears the clipboard after a certain amount of time, making it seem like the only weak point in the system is the paste functionality.)

To find out that this is not the case is pretty mind blowing. Does anybody know of any good reasons why the clipboard shouldn't be secure?

Post reply on HN