Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Permissions asked for by Uber Android app

gironsec.com

Post reply on HN
Print view View original

121–130 of 164 posts

Re: Permissions asked for by Uber Android app

#121

Post by [deleted] »

nhayden wrote: post #57
revelation wrote: post #14

Earlier quoted context omitted.

Just for completeness sake and judging from the function names, this is the list, with attributes stored for each: - Accounts log (Email) - App Activity (Name, PackageName, Process Number of activity, Processed id) - App Data Usage (Cache size, code size, data size, name, package name) - App Install (installed at, name, package name, unknown sources enabled, version code, version name) - Battery (health, level, plugg…

A lot of apps collect this information. There are flashlight apps that collect the same level. This is nothing new.

[deleted]

Re: Permissions asked for by Uber Android app

#122

Post by zeus180 »

I don't see that Uber has permissions to my SMS, however, after going through the other list of granted permissions, I went to the settings and modified the permission and also enabled privacy guard for the app. You can go to Settings -> Apps -> (scroll down) tap on Modify - screenshot http://i.imgur.com/AVXLqgh.png

Re: Permissions asked for by Uber Android app

#123

Post by bad_user »

beeworker wrote: post #95
MarkMc wrote: post #89

Earlier quoted context omitted.

Side note: Wouldn't it be good if Google required all apps to explain why each permission is necessary, similar to this?

It would also be good if users could install the app but without approving the full set of permissions. Developers would have to catch an exception, but it's worth it. (Supposedly with one of the recent Android releases this feature was planned and made it to some users but Google quickly reverted.)

The system in iOS is still not enough because the app knows if you declined, so it can keep asking you ad-nauseam until you either accept or until you uninstall the app. For example Facebook's messenger asks for being able to show notifications every time you load the UI.

It would have been good if there was a way to lie to the app. For example if it wants access to your contacts, it could get a blank list.

Of course, it is much easier to not use such apps in the first place. Uber is not alone in doing this and personally I take it as a signal of how I'll be treated as a customer.

Re: Permissions asked for by Uber Android app

#124

Post by dingaling »

click170 wrote: post #88

One way to deal with this is to filter all outbound requests and not let the requests that you've identified as "phoning home" to complete. Then, you test the app, if it still works you can continue using it. If it doesn't, you find a different service or you consider re-adjusting your restrictions. Outbound filtering can quickly highlight any app that tries to call home. Luckily, many apps continue working if you bl…

Sadly, filtering is a privilege only rooted Android users may enjoy despite there being a perfectly functional iptables/ iptables6 instance on every phone.

The first thing I do after rooting is install a front- end to iptables and set it to whitelist mode. Any app that has a genuine need to access the internet can then be authorised; everything else is denied.

It frustrates me greatly that the ' common user' is denied this protection.

Re: Permissions asked for by Uber Android app

#125

Post by joshuahutt »

bad_user wrote: post #123
beeworker wrote: post #95

Earlier quoted context omitted.

It would also be good if users could install the app but without approving the full set of permissions. Developers would have to catch an exception, but it's worth it. (Supposedly with one of the recent Android releases this feature was planned and made it to some users but Google quickly reverted.)

The system in iOS is still not enough because the app knows if you declined, so it can keep asking you ad-nauseam until you either accept or until you uninstall the app. For example Facebook's messenger asks for being able to show notifications every time you load the UI. It would have been good if there was a way to lie to the app. For example if it wants access to your contacts, it could get a blank list. Of course…

On rooted Android phones, there's XPrivacy, which can do just that--send fake data to an app.

https://github.com/M66B/XPrivacy

Re: Permissions asked for by Uber Android app

#126

Post by jamesaguilar »

tonyhb wrote: post #90
madeofpalk wrote: post #27

Earlier quoted context omitted.

Well I mean, is it actually causing any problems for Uber? Uber has what's pretty close to a monopoly in what it offers, apart from a few cities in the US where Lyft also operates. I would say most people that user Uber are not interested in using the regular local taxi service.

I spoke to a Lyft/Uber driver today in NCY. He said that Uber's losing drivers every day here — about 5% (I don't know where he got those numbers from). He also mentioned that Uber are flat out lying about how much drivers earn, and in some months drivers that aren't on Uber's "favourites" list end up owing Uber for renting the gear instead of earning money. This reputation is definitely damaging, and it's common kno…

How would a driver come about these numbers? And 5% per day? Pretty sure you were talking to someone not in the know.

Re: Permissions asked for by Uber Android app

#127

Post by driverdan »

krschultz wrote: post #114

As an Android developer, I don't want to have to ask for as many permissions as I do. I have 1 button buried on 1 screen that allows you to call customer support. 99.9% of users never click the button. However, I have to make every single customer accept the CALL_PHONE permission. There are a bunch of permissions required for basics like autocompleting the users email for login, or checking the network state so you c…

Why? All we have is a tel: link that opens the phone number in the dialer. They can choose to initiate the call or not, no permissions needed.

Re: Permissions asked for by Uber Android app

#128

Post by r00fus »

dvhh wrote: post #106
TillE wrote: post #44

Earlier quoted context omitted.

I have a lot of issues with iOS, but I think Apple's UX here is clearly superior: it asks you about each individual permission an app requests (not on install, but when the permission is first used), and allows you to deny it.

Wasn't that almost the same approach with UAC ?

As usual, Microsoft did it first, but got the UX all wrong. Apple comes along does something very similar, but because of the App Store and the infamous review cycle, can enforce some semblance of control over the app ecosystem.

Notice: Apple only does this fairly granular security on iOS, and OSX is much more similar to how Windows it.

Re: Permissions asked for by Uber Android app

#129

Post by nitrogen »

hero454545 wrote: post #49
revelation wrote: post #14

Earlier quoted context omitted.

Just for completeness sake and judging from the function names, this is the list, with attributes stored for each: - Accounts log (Email) - App Activity (Name, PackageName, Process Number of activity, Processed id) - App Data Usage (Cache size, code size, data size, name, package name) - App Install (installed at, name, package name, unknown sources enabled, version code, version name) - Battery (health, level, plugg…

Well it's very popular among users. Removing it from the store immediately and/or permanently seems likely to get some backlash from the user base.

The same could be said about a lot of things that are harmful to users.

Re: Permissions asked for by Uber Android app

#130

Post by rahimnathwani »

TheCoreh wrote: post #116
andymcsherry wrote: post #98

Earlier quoted context omitted.

iOS really has 3 levels of access for things like this. For the most sensitive things like location, contacts and photos, it prompts for user permission. There's a lower category for things like background processing, you declare to Apple that you want to use them, and they are enabled by default. Some of them can be disabled by the user after the fact. Then, there's things like internet usage which there is no permi…

Because of iOS's sandboxing, it's really hard for apps to get info outside of their own "container" of sorts, so it doesn't matter much if they can access the Internet. Keyboards from third parties are an obvious exception to this, so these require explicit permission to access the Internet.

> so it doesn't matter much if they can access the Internet

Unless you have a limited cellular data allowance, or pay for data by actual usage. iOS allows you to disable cellular data for certain apps. It would be great if it could somehow figure out when I'm using a mi-fi when abroad, and treat that wifi access point as 'cellular'.

Post reply on HN