Uber wants access to browsing history, bookmarks, and running apps • Hacker News Board

Re: Uber wants access to browsing history, bookmarks, and running apps

#241

Post by jfrisby » Mon, Apr 18, 2016, 1:39 AM UTC

decisiveness wrote: post #240

makeramen wrote: post #236

Uber engineer here. These permissions were mistakenly introduced by an engineer on the team who thought a 3rd party library needed them when in fact it does not. We definitely do not need or want those permissions and we’ve promptly released new versions to the Play Store that do not request them. Please upgrade to Uber app version 3.98.3 (3.99.2 in the beta channel) which no longer requests the extra permissions.

> These permissions were mistakenly introduced by an engineer on the team who thought a 3rd party library needed them when in fact it does not. What caused the engineer to be mistaken about this? What library? Considering Uber's history, expecting people to believe a claim like: "one guy acted alone in an oopsy", without providing a more detailed report, is a bit optimistic.

If they did indeed immediately release an update that ceases asking for these permissions, then I'd say this is an entirely reasonable explanation regardless of their history.

Re: Uber wants access to browsing history, bookmarks, and running apps

#242

Post by dredmorbius » Mon, Apr 18, 2016, 2:20 AM UTC

magicalist wrote: post #183

dredmorbius wrote: post #137

Google released, then withdrew, an interface for revoking and limiting application permissions. On existing Android devices. Three years ago. We know they can do this. We also know they don't care. The challenge is to make them care. https://www.eff.org/deeplinks/2013/12/google-removes-vital-p...

Yeah, it would be awesome if they would release an android update that allowed you to revoke and limit application permissions. http://android-developers.blogspot.com/2015/08/building-bett...

As I understand it, that puts the onus fully on application developers, whom users have to trust.

That's precisely the current problem.

Re: Uber wants access to browsing history, bookmarks, and running apps

#243

Post by decisiveness » Mon, Apr 18, 2016, 2:54 AM UTC

jfrisby wrote: post #241

decisiveness wrote: post #240

Earlier quoted context omitted.

> These permissions were mistakenly introduced by an engineer on the team who thought a 3rd party library needed them when in fact it does not. What caused the engineer to be mistaken about this? What library? Considering Uber's history, expecting people to believe a claim like: "one guy acted alone in an oopsy", without providing a more detailed report, is a bit optimistic.

If they did indeed immediately release an update that ceases asking for these permissions, then I'd say this is an entirely reasonable explanation regardless of their history.

I could be wrong, but without a real explanation, it seems more likely Uber is still convinced analyzing customer behavior in the most personally invasive ways is worth the risk, and were testing the waters, hoping a response like the OP's wouldn't gain traction the way it did.

In a company with thousands of employees, already scrutinized for privacy violations, it's hard to believe that a single engineer could ask for the most sensitive of permissions without anyone else reviewing or bumping up the chain first.

Re: Uber wants access to browsing history, bookmarks, and running apps

#244

Post by dredmorbius » Mon, Apr 18, 2016, 2:55 AM UTC

makeramen wrote: post #236

Uber engineer here. These permissions were mistakenly introduced by an engineer on the team who thought a 3rd party library needed them when in fact it does not. We definitely do not need or want those permissions and we’ve promptly released new versions to the Play Store that do not request them. Please upgrade to Uber app version 3.98.3 (3.99.2 in the beta channel) which no longer requests the extra permissions.

1. Thanks and good on Uber for correcting this, and communicating this publicly. That's excellent goodwill, and something the company could use more of. Now make sure this doesn't happen again.

2. The change likely would not have been made had people not complained.

This is why I am reporting excessive Android permissions requests, both to developers and publicly. I've succeeded in having several other instances of expansive permissions requests rolled back. Others not so much (e.g., Wikipedia).

3. I'd argue that this only further highlights how broken the Android permissions systems are if applications can request unnecessary and highly dangerous and invasive permissions without the awareness of the authors. I love a few things about my Android device, but few of them specifically pertain to Android.

4. As I've mentioned already: Google need to reintroduce their applications permissions blocking tool which was released AND WITHDRAWN in 2013. For all prior versions of Android.

5. Someone really needs to kick Google's ass with a a) Free Software b) user-first c) privacy-respecting d) security conscious operating system for small mobile devices. Maybe Microsoft can be talked into funding Ubuntu Mobile or FirefoxOS.

Re: Uber wants access to browsing history, bookmarks, and running apps

#245

Post by makeramen » Mon, Apr 18, 2016, 3:37 AM UTC

decisiveness wrote: post #243

jfrisby wrote: post #241

Earlier quoted context omitted.

If they did indeed immediately release an update that ceases asking for these permissions, then I'd say this is an entirely reasonable explanation regardless of their history.

I could be wrong, but without a real explanation, it seems more likely Uber is still convinced analyzing customer behavior in the most personally invasive ways is worth the risk, and were testing the waters, hoping a response like the OP's wouldn't gain traction the way it did. In a company with thousands of employees, already scrutinized for privacy violations, it's hard to believe that a single engineer could ask f…

You're right that we have a very strict review process for added permissions, but unfortunately due to the way libraries and Android's manifest merger work, this change managed to slip through our standard review process. We're definitely going to add stricter enforcement to make sure something like this doesn't happen again.

Re: Uber wants access to browsing history, bookmarks, and running apps

#246

Post by fabulist » Mon, Apr 18, 2016, 5:55 AM UTC

dredmorbius wrote: post #244

makeramen wrote: post #236

Uber engineer here. These permissions were mistakenly introduced by an engineer on the team who thought a 3rd party library needed them when in fact it does not. We definitely do not need or want those permissions and we’ve promptly released new versions to the Play Store that do not request them. Please upgrade to Uber app version 3.98.3 (3.99.2 in the beta channel) which no longer requests the extra permissions.

1. Thanks and good on Uber for correcting this, and communicating this publicly. That's excellent goodwill, and something the company could use more of. Now make sure this doesn't happen again. 2. The change likely would not have been made had people not complained. This is why I am reporting excessive Android permissions requests, both to developers and publicly. I've succeeded in having several other instances of e…

> 5. Someone really needs to kick Google's ass with a a) Free Software b) user-first c) privacy-respecting d) security conscious operating system for small mobile devices. Maybe Microsoft can be talked into funding Ubuntu Mobile or FirefoxOS.

The fellows at https://copperhead.co look to be doing solid work.

Re: Uber wants access to browsing history, bookmarks, and running apps

#247

Post by rcheu » Mon, Apr 18, 2016, 7:53 AM UTC

paulddraper wrote: post #150

rcheu wrote: post #149

I believe the browser history lookup doesn't work anymore (I tried recently on 5.0 I believe). Also, many of the Android permissions are unecessarily broad, I think that really would be a good thing to fix. Oftentimes you only need some specific function, but have to request a much broader range.

Examples? (Especially any for browsing history, bookmarks, or running apps.)

Getting a list of accounts (needed if you want to integrate with Google login), asks the user if the app can read their contacts: https://code.google.com/p/android/issues/detail?id=189766#c8.

Another example is phone state https://arnowelzel.de/wp/en/android-and-read_phone_state (games use this to adjust volume to not drown out calls). There is a replacement, but it's not well known.

Re: Uber wants access to browsing history, bookmarks, and running apps

#248

Post by strcat » Mon, Apr 18, 2016, 9:43 AM UTC

dredmorbius wrote: post #242

magicalist wrote: post #183

Earlier quoted context omitted.

Yeah, it would be awesome if they would release an android update that allowed you to revoke and limit application permissions. http://android-developers.blogspot.com/2015/08/building-bett...

As I understand it, that puts the onus fully on application developers, whom users have to trust. That's precisely the current problem.

No, it does not. Dangerous permission can be toggled off for all apps now. For apps on the new API level, they can no longer obtain dangerous permissions at install time. They have to trigger an OS-level prompt for the permission. They're supposed to explain why they need it before triggering the OS prompt and many apps did it poorly by adding an extra, meaningless prompt before the real one. This was't done for the old API level because it would cause crashes for permissions where data can't feasibly be faked and the user would have no indication that fake/empty data was being used if it was the default.

Re: Uber wants access to browsing history, bookmarks, and running apps

#249

Post by technofiend » Mon, Apr 18, 2016, 2:55 PM UTC

anowlcalledjosh wrote: post #205

technofiend wrote: post #84

Earlier quoted context omitted.

Sure it does: my browsing history, contacts, etc are separate and distinct for each profile. To the best of my knowledge there is no Android permission that'll let you cross that boundry. Please, if you know of evidence to the contrary please share a link to the Android docs. That would be a reason to root my phone and run a release with a privacy plugin.

There is absolutely a permission for that, it's called INTERACT_ACROSS_USERS. I suspect what you mean is 'is there a permission accessible by normal apps that can do this', to which the answer is no - the permission is signature-level, meaning the app must be signed with the same key as the OS to be able to access the permission. I can't find a page from the official docs from my phone, but there's a list of permissi…

Thank you for the correction, but my point stands: unless it's signed by Google's OS key it won't be able to cross that boundary. Although since ABC is a major investor in Uber...

Re: Uber wants access to browsing history, bookmarks, and running apps

#250

Post by deskamess » Mon, Apr 18, 2016, 3:46 PM UTC

dredmorbius wrote: post #244

makeramen wrote: post #236

Uber engineer here. These permissions were mistakenly introduced by an engineer on the team who thought a 3rd party library needed them when in fact it does not. We definitely do not need or want those permissions and we’ve promptly released new versions to the Play Store that do not request them. Please upgrade to Uber app version 3.98.3 (3.99.2 in the beta channel) which no longer requests the extra permissions.

1. Thanks and good on Uber for correcting this, and communicating this publicly. That's excellent goodwill, and something the company could use more of. Now make sure this doesn't happen again. 2. The change likely would not have been made had people not complained. This is why I am reporting excessive Android permissions requests, both to developers and publicly. I've succeeded in having several other instances of e…

Is there a website where we can report or add our voice to apps that seem to request too much permissions. Some of the online course apps seem to do that (udemy, edx, etc).