51–60 of 164 posts
I do find it funny that despite all the other allegations, absolutely reprehensible business practices, and general malice they've put in the world that this is a surprise to anyone. I'm quite surprised that they still have so much business, but then again, morality isn't a one-size fits all sort of deal. What bothers me, may not bother other folks, or may seem as smart business tactics ( :sadface: ).
To me, it's just more icing on the cake.
Earlier quoted context omitted.
It's worth noting that the quick summation of Android permissions given to users isn't quite accurate. There are a limited number of permissions, and many of them (such as SD card read/write access) are very broad. So the summary Google uses is a lay description of the worst possible thing an app could do with those permissions, which may be much more invasive than what it actually does.
The permission model is broken. I should not give permission at install-time, it should be asked at runtime, at OS-level, and I MUST be allowed to say no anytime .. if I trust the app enough, then I should be able to say "allow the app to do that thing for this hour/day/month/always" why mobile OS authors haven't learn anything from the web security model yet?
Which mobile OS authors? The behavior you described is default in iOS.
Google cache: http://webcache.googleusercontent.com/search?q=cache:http://...
TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…
I wiped an old Android phone, configured it with a dummy Gmail account, and then installed the Uber app there.
So it's a dedicated Uber-only phone with no contacts, no personal data, powered off until I need a ride. It's a giant pain in the ass.
Kinda happy to see this article, it validates my paranoia in some small way.
Now the real question is, why use Uber at all if they're this cavalier with my personal information? Good question, I may not need to power-on my Uber-only phone any more.
Android needs a sandbox, which will provide apps with empty contacts, call history, fake location and so on. Does such sandbox exists?
Further reading: http://www.androidpolice.com/2013/07/25/app-ops-android-4-3s...
TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…
Just for completeness sake and judging from the function names, this is the list, with attributes stored for each: - Accounts log (Email) - App Activity (Name, PackageName, Process Number of activity, Processed id) - App Data Usage (Cache size, code size, data size, name, package name) - App Install (installed at, name, package name, unknown sources enabled, version code, version name) - Battery (health, level, plugg…
Earlier quoted context omitted.
Just for completeness sake and judging from the function names, this is the list, with attributes stored for each: - Accounts log (Email) - App Activity (Name, PackageName, Process Number of activity, Processed id) - App Data Usage (Cache size, code size, data size, name, package name) - App Install (installed at, name, package name, unknown sources enabled, version code, version name) - Battery (health, level, plugg…
> I really don't see any reason for Google not to immediately remove this app from the store permanently and ban whatever developer uploaded it The original article is down, but do they somehow bypass the Android permission authorization process? Or the user still has to authorize the app to access all the resources?
The issue is that they're phoning all this information home, when the user might only be expecting it to be retrieved while the app is in use and only as needed.
Here's what Uber says about its Android permissions -- the page isn't that difficult to find: https://m.uber.com/android-permissions
Uber says the camera permission is required to take a snapshot of your credit card. The phone call permission is required to call your driver. The get accounts permission is required to enable single sign-in (Google Sign-In, Google Wallet).
The Uber app doesn't, according to the gironsec.com post, request Android's READ_SMS permission, so pointing to a "sendSMSLog" code excerpt by itself doesn't mean much. And so on.
As pointed out elsewhere in this thread, there's a "perfectly reasonable explanation for almost all of these permissions" except WRITE_SETTINGS. Uber says in its Android permissions post that: "We use this permission to save data and cache mapping vectors."
It seems as though it would have been useful for the author of the gironsec.com post to read what Uber has to say -- or, better yet, contact the company before posting a critique. If Uber PR can't cough up a good explanation, it makes the final critique more powerful.
I've posted here on HN criticizing Uber before (https://news.ycombinator.com/item?id=8383854), but before rushing to judgment here let's check our facts first.
Recall that PUT / DELETE aren’t official HTTP requests, rather extensions implemented via WebDav. Modern applications don’t bother with these requests since its easier / more secure to perform those same actions with a server side language. Apparently the author has not ever heard of REST. I'm a little shocked by that.
+ credit card check banner
+ stolen template notification?