Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1k Android apps harvest data even after you deny permissions

cnet.com

Post reply on HN
Print view View original

61–70 of 146 posts

Re: More than 1k Android apps harvest data even after you deny permissions

#61

Post by ceejayoz »

autoexec wrote: post #56
ceejayoz wrote: post #29

Earlier quoted context omitted.

> If I wanted you to know where I took the picture, I would tell you. That's really missing the major use case, though, isn't it? I like having it enabled so my phone will tell me where I took the picture, because there's little chance I'll be able to a year later. It'd be nice if the "access photos" API on the device would have a separate permission for EXIF data. Without it, the app would receive only the image its…

That still leaves google collecting your location info from the EXIF data just as I assume facebook collects your as it is stripped out. Google doesn't need to know the exact date, time, and location every photo I take was taken either.

If Google's part of your threat model, it's probably time to ditch the Android phone entirely. No amount of permissions is really going to matter.

Re: More than 1k Android apps harvest data even after you deny permissions

#62

Post by lern_too_spel »

scarface74 wrote: post #44
ocdtrekkie wrote: post #24

Earlier quoted context omitted.

I mean, as much as I'd like to give Android crud here, I think this is incredibly unethical developer behavior, and it's kind of incredible to see we still have so many people in the industry who think scraping location data out of people's stored photos for advertising data is okay. It's well outside the realm of something I'd think someone would even try to do, especially from a pretty legitimate company like Shutt…

Yes Android is to blame. The entire idea behind a sandboxed mobile OS is that random developers can’t be trusted not to invade your privacy. But honestly neither can Google, but that’s another story...

If you upload a picture to Shutterfly, that is a user specifically putting the photo in the app's sandbox. The same thing happens on every other OS.

Re: More than 1k Android apps harvest data even after you deny permissions

#63

Post by fitzroy »

alvern wrote: post #26

[0] from the researchers pdf: • We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through a combination of dynamic and static analysis, in effect creating a scalable honeypot environment. • We tested our pipeline on more than 88,000 apps and discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the U.S. Google Play…

The picture metadata exploit is interesting. It would be trivial to guess the user's home and work location given enough photos with EXIF data (locations and timestamps).

I'm curious how this works on iOS. Granting complete access to "Photos" always seemed overly broad. It should be possible to limit an app to only save images, and/or limit accessing images to photos from the last 3 days etc, or only the images the app has created.

Allowing an app to grab literally years of time and location information (via photo EXIF data) just to do something as simple as saving a filtered picture or opening a screenshot seems bad.

But as someone who loves metadata, I'd can't see myself disabling it altogether. Does anyone know how this works today on iOS? Can an app wholesale upload thousands of pics (or just the metadata) in the background without the user knowing?

Re: More than 1k Android apps harvest data even after you deny permissions

#64

Post by srcmap »

baybal2 wrote: post #40
Avamander wrote: post #34

Earlier quoted context omitted.

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

Will google dare to ban alibaba? Alibaba does no effort to conceal that they target ads by IMEI. Browse Alibaba app*, search something. Do factory reset, make new account, and the first thing you will see after logging in with new acc will be your products from your last search. Moreover, Alibaba's app will refuse to work if you block IMEI retrieval, or if they detect some kind of spoofing edit, made it clear that it…

Maybe someone in EU can file a class action lawsuit base on GDPR?

Per description here, it seems have enough legal, $, evident here to make a few lawyers excited?

Re: More than 1k Android apps harvest data even after you deny permissions

#65

Post by Ajedi32 »

gruez wrote: post #60
Ajedi32 wrote: post #41

Earlier quoted context omitted.

This particular issue should be fixed by Android Q's new "scoped storage" permission model: https://developer.android.com/preview/privacy/scoped-storage...

Looks like apps can opt out via an api call, so it's not really a security measure.

That's only for the beta build of Android Q. It won't work in the production release.

Re: More than 1k Android apps harvest data even after you deny permissions

#66

Post by autoexec »

panpanna wrote: post #5

> The update will address the issue by hiding location information in photos from apps and requiring any apps that access Wi-Fi to also have permission for location data, according to Google. The great minds at Google have done it again!! This craziness (Bluetooth requires location) was the reason I never bought a smartwatch. I guess now I should stop using internet too.

> and requiring any apps that access Wi-Fi to also have permission for location data, according to Google.

Doesn't this just force everyone who uses an app with their wireless connection to give that app access their location data too? That seems like forcing users to leak more of their data rather than protecting it.

Now instead of some apps that I've denied location access getting it anyway by trickery, I now have to allow all apps to record my location data or else they can't access the internet at all!

Re: More than 1k Android apps harvest data even after you deny permissions

#67

Post by Gibbon1 »

Avamander wrote: post #34
alvern wrote: post #26

[0] from the researchers pdf: • We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through a combination of dynamic and static analysis, in effect creating a scalable honeypot environment. • We tested our pipeline on more than 88,000 apps and discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the U.S. Google Play…

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

Thought of the day, collecting certain types of information on people should require posting a bond and an annual audit and disclosure.

No bond, no audit, no disclosure -> felony.

Re: More than 1k Android apps harvest data even after you deny permissions

#68

Post by lern_too_spel »

autoexec wrote: post #59
izacus wrote: post #32

Earlier quoted context omitted.

What exactly is the blame of Android? That it allows the app to read photos when user allows it to read photo files? Because this criminal behaviour is also present in Linux, Windows and macOS. Or the fact that an app can write a file to disk? And then another app can open the file? Also criminal behaviour present in other operating systems. Some users might even call it a feature and do the unthinkable - share files…

> Seriously, you're blaming the OS because it allows you to run useful software on it, just like a desktop computer. Unlike a desktop computer Android prevents you from taking steps to protect yourself. Without rooting your phone you can't even install firewalls or prevent applications from ever connecting to the outside world. Google designed their OS to collect and leak your data. It's why their permissions system…

> Without rooting your phone you can't even install firewalls or prevent applications from ever connecting to the outside world.

Of course you can. There are multiple apps that do this. One example: https://f-droid.org/en/packages/eu.faircode.netguard/

Re: More than 1k Android apps harvest data even after you deny permissions

#69

Post by izacus »

ceejayoz wrote: post #29
giancarlostoro wrote: post #8

Earlier quoted context omitted.

> Researchers found that Shutterfly, a photo-editing app, had been gathering GPS coordinates from photos and sending that data to its own servers, even when users declined to give the app permission to access location data. One of the first things I disable when I have a new phone is geolocation being added to photos. I just don't want my location randomly being shared from an image without my consent. If I wanted yo…

> If I wanted you to know where I took the picture, I would tell you. That's really missing the major use case, though, isn't it? I like having it enabled so my phone will tell me where I took the picture, because there's little chance I'll be able to a year later. It'd be nice if the "access photos" API on the device would have a separate permission for EXIF data. Without it, the app would receive only the image its…

This is actually the change coming to Android Q - OS will strip out location data from photos when apps access them. EXIF will require extra permissions.

Re: More than 1k Android apps harvest data even after you deny permissions

#70

Post by scarface74 »

lern_too_spel wrote: post #62
scarface74 wrote: post #44

Earlier quoted context omitted.

Yes Android is to blame. The entire idea behind a sandboxed mobile OS is that random developers can’t be trusted not to invade your privacy. But honestly neither can Google, but that’s another story...

If you upload a picture to Shutterfly, that is a user specifically putting the photo in the app's sandbox. The same thing happens on every other OS.

Not with iOS. There is a separate media library API that’s separate from the file access API. You can give an app permission to access your media library without giving it access to the location metadata. The app has to specifically ask for location access to get the metadata.
Post reply on HN