101–110 of 112 posts
There wasn't the normal "this app wants ___ permissions, is that cool?" message from the Google OAuth dialog. I had not idea I'd authorized Niantic to go scrape all my emails, access Google's own processing on them for advertisement system training or review my location history, for example.
I'm not so sure why I should believe they didn't do that.
Earlier quoted context omitted.
It's not size directly, but the risk of goodwill. A bigger company stands to lose more goodwill.
I disagree. I think the bigger the company, the more likely they less care about users/support/their image. They're 'too big to fall' and the sheep are already on the ship. I believe there's plenty of examples out there, I can give you two straight away [1], [2]. [1] https://news.ycombinator.com/item?id=5523992 [2] https://news.ycombinator.com/item?id=12034608
Earlier quoted context omitted.
I disagree. I think the bigger the company, the more likely they less care about users/support/their image. They're 'too big to fall' and the sheep are already on the ship. I believe there's plenty of examples out there, I can give you two straight away [1], [2]. [1] https://news.ycombinator.com/item?id=5523992 [2] https://news.ycombinator.com/item?id=12034608
Google cares a lot about user privacy. If only a few percent of their users change their default search engine from Google to DuckDuckGo, they will loose a lot of revenue.
[1] https://news.ycombinator.com/item?id=12035667
Earlier quoted context omitted.
And see TLS traffic? How would this help anyone?
A MITM proxy typically means a decrypting proxy, so you can see all the traffic, irregardless of if it's wrapped in TLS.
Take a look at this list of potential things you can ask for as a developer: https://developers.google.com/identity/protocols/googlescope... And most folks will click "Approve" without really reviewing the list. That said, Twitter and Facebook (two other popular OAuth providers) heavily restrict certain "full" access to only trusted applications that they either have a business relationship with or otherwise review t…
Before you could also get stuff like education and work history, family relationships, relationship status, sexual orientation and a whole load of other stuff that could potentially cause a lot of trouble. And people would happily click OK just to play FarmVille or whatever.
Now Facebook makes it so any app needing advanced permissions data has to be reviewed by Facebook first.
See https://developers.facebook.com/blog/post/2014/04/30/the-new...
Earlier quoted context omitted.
A MITM proxy typically means a decrypting proxy, so you can see all the traffic, irregardless of if it's wrapped in TLS.
I thought that Google and other app writers weren't keen on blindly accepting generated certificates, and used certificate pinning. Do they really accept anyone's google.com certificates?
Earlier quoted context omitted.
The company is actualy owned by Google.
The company WAS owned by Google. They left Google in August 2015 to become an independent entity.
Earlier quoted context omitted.
If you want to be paranoid, you could run a MITM proxy from your computer between your phone and Niantic's servers.
And see TLS traffic? How would this help anyone?
> Charles can be used as a man-in-the-middle HTTPS proxy, enabling you to view in plain text the communication between web browser and SSL web server.
From https://www.charlesproxy.com/documentation/proxying/ssl-prox...
Earlier quoted context omitted.
A MITM proxy typically means a decrypting proxy, so you can see all the traffic, irregardless of if it's wrapped in TLS.
I thought that Google and other app writers weren't keen on blindly accepting generated certificates, and used certificate pinning. Do they really accept anyone's google.com certificates?
> Charles does this by becoming a man-in-the-middle. Instead of your browser seeing the server’s certificate, Charles dynamically generates a certificate for the server and signs it with its own root certificate (the Charles CA Certificate). Charles receives the server’s certificate, while your browser receives Charles’s certificate. Therefore you will see a security warning, indicating that the root authority is not trusted. If you add the Charles CA Certificate to your trusted certificates you will no longer see any warnings – see below for how to do this.
https://www.charlesproxy.com/documentation/proxying/ssl-prox...
It seems you are correct if they use pinning:
> Note that some apps implement SSL certificate pinning which means they specifically validate the root certificate. Because the app is itself verifying the root certificate it will not accept Charles's certificate and will fail the connection. If you have successfully installed the Charles root SSL certificate and can browse SSL websites using SSL Proxying in Safari, but an app fails, then SSL Pinning is probably the issue.
https://www.charlesproxy.com/documentation/faqs/ssl-connecti...
Isn't this a bit: "Accidentally left open gate to castle. Now closed. No fix in place to make sure other people working closely with Alphabet/Google won't leave door open again. Share and enjoy." ? On another note, from the "privacy policy": 1. REVISIONS TO THIS PRIVACY POLICY Any information that is collected via our services is covered by the privacy policy in effect at the time such information is collected we may…
> So, they'll let you know if they apply retroactive changes to the policy? Pretty standard for a lot of apps and web services. The alternative is not to use them, or to be very conscious about what data you supply them with. Most people just click accept (as with any EULA).