Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1k Android apps harvest data even after you deny permissions

cnet.com

Post reply on HN
Print view View original

81–90 of 146 posts

Re: More than 1k Android apps harvest data even after you deny permissions

#81

Post by autoexec »

ceejayoz wrote: post #61
autoexec wrote: post #56

Earlier quoted context omitted.

That still leaves google collecting your location info from the EXIF data just as I assume facebook collects your as it is stripped out. Google doesn't need to know the exact date, time, and location every photo I take was taken either.

If Google's part of your threat model, it's probably time to ditch the Android phone entirely. No amount of permissions is really going to matter.

google should be part of everyone's threat model, but while we're forced to live with google and forced to hand over some data, it's best to limit what we send them voluntarily whenever we have any option.

Re: More than 1k Android apps harvest data even after you deny permissions

#82

Post by Avamander »

scarface74 wrote: post #42
Avamander wrote: post #34

Earlier quoted context omitted.

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

If the app can get around the permission system - it’s a vulnerability in Android itself that Google needs to correct.

Usually apps that exploit flaws in Android are even labeled malicious and actively removed from all devices, this might be even better than just perma-banning the developers.

Re: More than 1k Android apps harvest data even after you deny permissions

#83

Post by JoshTriplett »

scarface74 wrote: post #42
Avamander wrote: post #34

Earlier quoted context omitted.

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

If the app can get around the permission system - it’s a vulnerability in Android itself that Google needs to correct.

Sure. And if an app intentionally exploits that vulnerability to bypass the permission system, its developer should no longer be able to publish in the Play Store.

Re: More than 1k Android apps harvest data even after you deny permissions

#84

Post by JoshTriplett »

StreamBright wrote: post #75
srcmap wrote: post #64

Earlier quoted context omitted.

Maybe someone in EU can file a class action lawsuit base on GDPR? Per description here, it seems have enough legal, $, evident here to make a few lawyers excited?

Not really unless they are stealing PII.

IP addresses are considered PII, and IMEIs are in every way worse than IP addresses.

Re: More than 1k Android apps harvest data even after you deny permissions

#85

Post by StreamBright »

JoshTriplett wrote: post #84
StreamBright wrote: post #75

Earlier quoted context omitted.

Not really unless they are stealing PII.

IP addresses are considered PII, and IMEIs are in every way worse than IP addresses.

The router’s MAC is not PII for example. This is why I write that GDPR only applies in case they collect actual PII.

Re: More than 1k Android apps harvest data even after you deny permissions

#86

Post by unfoldedCravat »

There certainly is a way to make it so an app can ‘add photos only’ on iOS. I have only seen it used a handful of time and some apps like Facebook Messenger where I’ve somehow got that permission setting set in the past actually ignore it and demand full access despite just trying to save a photo.

https://stackoverflow.com/questions/46341694/detect-add-phot...

Re: More than 1k Android apps harvest data even after you deny permissions

#87

Post by favorited »

izacus wrote: post #69
ceejayoz wrote: post #29

Earlier quoted context omitted.

> If I wanted you to know where I took the picture, I would tell you. That's really missing the major use case, though, isn't it? I like having it enabled so my phone will tell me where I took the picture, because there's little chance I'll be able to a year later. It'd be nice if the "access photos" API on the device would have a separate permission for EXIF data. Without it, the app would receive only the image its…

This is actually the change coming to Android Q - OS will strip out location data from photos when apps access them. EXIF will require extra permissions.

That's awesome. I have EXIF-stripping apps which I use to remove location data before uploading them in other apps, but for all I know the EXIF-stripping apps are harvesting the location data themselves...

Re: More than 1k Android apps harvest data even after you deny permissions

#88

Post by HenryBemis »

lern_too_spel wrote: post #68
autoexec wrote: post #59

Earlier quoted context omitted.

> Seriously, you're blaming the OS because it allows you to run useful software on it, just like a desktop computer. Unlike a desktop computer Android prevents you from taking steps to protect yourself. Without rooting your phone you can't even install firewalls or prevent applications from ever connecting to the outside world. Google designed their OS to collect and leak your data. It's why their permissions system…

> Without rooting your phone you can't even install firewalls or prevent applications from ever connecting to the outside world. Of course you can. There are multiple apps that do this. One example: https://f-droid.org/en/packages/eu.faircode.netguard/

Android: without rooting your phone, I keep writing this on HN :) it is called "NoRoot Firewall". Free app, it creates a VPN within your phone and asks you for every ip:port to allow/block and one can also use rules such as Block 111.111.., port: 123. Worth checking out. I have e.g. a chess app, I keep it block all IPs/Ports. I never have to worry for tracking, spying, ads, etc.

Re: More than 1k Android apps harvest data even after you deny permissions

#89

Post by JoshTriplett »

StreamBright wrote: post #85
JoshTriplett wrote: post #84

Earlier quoted context omitted.

IP addresses are considered PII, and IMEIs are in every way worse than IP addresses.

The router’s MAC is not PII for example. This is why I write that GDPR only applies in case they collect actual PII.

Several jurisdictions consider MAC addresses to be personal information as well.

Re: More than 1k Android apps harvest data even after you deny permissions

#90

Post by autoexec »

lern_too_spel wrote: post #78
autoexec wrote: post #76

Earlier quoted context omitted.

From their own FAQ: > NetGuard will do its best, but it is limited by the fact it must use the VPN service. FAQ: https://github.com/M66B/NetGuard/blob/master/FAQ.md See also: https://www.reddit.com/r/Android/comments/4uhl3w/netguard_ad...

VPNService is an API ( https://developer.android.com/reference/android/net/VpnServi... ). Your own link points tp this documentation. It does not require sending your data to a VPN, and in this case, it obviously doesn't. The weird thing is that you went out of your way to research to find a misleading quote when the page itself points out why the quote is misleading and that the app is open source (negating your ads…

It has to route traffic through a local VPN to drop the traffic. Doesn't play well with other VPNs for this reason. Real firewalls need root. The VPN trick is a hack to get around that while still providing some of that functionality. Yes, you could edit the source code and compile it yourself every time it updates to remove the ads, but I think that's a little much to expect.

Ultimately this is functionality users should have access to by default without needing to resort to hacks and ad-filled workarounds.

Post reply on HN