Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1k Android apps harvest data even after you deny permissions

cnet.com

Post reply on HN
Print view View original

141–146 of 146 posts

Re: More than 1k Android apps harvest data even after you deny permissions

#141

Post by salamander014 »

Ajedi32 wrote: post #50
Avamander wrote: post #34

Earlier quoted context omitted.

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

It seems like at least some of these apps might be using these vulnerabilities without even being aware of it, as the offending code is in third party libraries. Game devs grabbing mac addresses via Unity's API, for example, may not know that that information is supposed to be restricted on Android.

If these apps get banned because they use poor dependencies, maybe better dependencies will become popular, and developers will also have a reason to be more aware of what code they are using.

Re: More than 1k Android apps harvest data even after you deny permissions

#142

Post by mirimir »

JadeNB wrote: post #139
mirimir wrote: post #108

Earlier quoted context omitted.

Here's a simple experiment. On a Linux box, open your GUI text editor. Try to open /var/log/syslog. You will see "Permission denied". That's because only apps with root can access /var/*.

I agree that's a simple experiment. What does it demonstrate?

You said this:

> I assume that anything I install has whatever privileges I have (or root privileges, given the broken must-install-as-root behaviour of many of them).

My point is that Linux apps don't have general root rights. Even though you must install them as root. That is, unless you start them as root. So an app can't just decide to access and change some other app's settings.

Re: More than 1k Android apps harvest data even after you deny permissions

#143

Post by snaky »

favorited wrote: post #87
izacus wrote: post #69

Earlier quoted context omitted.

This is actually the change coming to Android Q - OS will strip out location data from photos when apps access them. EXIF will require extra permissions.

That's awesome. I have EXIF-stripping apps which I use to remove location data before uploading them in other apps, but for all I know the EXIF-stripping apps are harvesting the location data themselves...

https://f-droid.org/en/packages/com.jarsilio.android.scrambl...

Re: More than 1k Android apps harvest data even after you deny permissions

#144

Post by JadeNB »

mirimir wrote: post #142
JadeNB wrote: post #139

Earlier quoted context omitted.

I agree that's a simple experiment. What does it demonstrate?

You said this: > I assume that anything I install has whatever privileges I have (or root privileges, given the broken must-install-as-root behaviour of many of them). My point is that Linux apps don't have general root rights. Even though you must install them as root. That is, unless you start them as root. So an app can't just decide to access and change some other app's settings.

> My point is that Linux apps don't have general root rights. Even though you must install them as root. That is, unless you start them as root.

I'm running macOS, so this isn't directly relevant; I don't know much about Linux apps, but macOS ones often do some skulduggery—for example, Dropbox uses its root installation privileges to make some very hard-to-eradicate startup items (https://applehelpwriter.com/2016/08/29/discovering-how-dropb...). Nonetheless, you are right that I was confusing "installed as root" with "has root privileges".

> So an app can't just decide to access and change some other app's settings.

Hopefully!—at least if this happens it's a bug.

Re: More than 1k Android apps harvest data even after you deny permissions

#145

Post by panpanna »

anticensor wrote: post #57
panpanna wrote: post #16

Earlier quoted context omitted.

Please take a step back and look at this again. What is the cause and what is the effect here? Is Google's solution making it better or worse from a practical privacy point of view? (Also, don't buy Google's explanation that this is just to inform users of potential misuse - they actually log your location and even wait for a GPS lock when you pair a new device)

What happens when you disable GPS system-level and allowed Bluetooth? Does discovery fail?

Yes

Re: More than 1k Android apps harvest data even after you deny permissions

#146

Post by antpls »

izacus wrote: post #30
driverdan wrote: post #6

Why do they have to wait for Android Q? Couldn't they pull the apps now?

They can pull the apps, but Android Q will add several additional security features - e.g. scoped storage (no more SD card access without user consent), EXIF location stripping (accessing EXIF from photos will require additional permissions) and plugging of several possible fingerprinting sidechannels.

This really feels like a cat and mouse game, with Google not actually trying to solve the issue. The proposed additional security "features" will give a false sense of security.

Any way for 2 apps to communicate together will be exploited for the same purpose in the future. Google would have to fix the issue in a more fundamental level, which requires better understanding of users habits and wishes in term of privacy.

But obviously, privacy-oriented users are the worst users for an ad network machine...

Post reply on HN