Slashdot Mirror

← Back to Stories (view on slashdot.org)

Privacy Concerns With Android and iPhone Apps

Posted by timothy on from the wouldn't-exactly-say-I've-been-missing-it dept.

carre4 writes "The Wall Street Journal has come out with an article where they examine 101 popular smartphone apps and show that 56 of them transmit various types of information including unique phone IDs, age, gender, postal codes, and location to ad companies. The article also includes responses from infringing app makers and talks about the pressure that some developers feel to share even more information, like Max Binshtok, creator of the DailyHoroscope for Android, who has been encouraged by ad-network executives to transmit users' locations."

82 of 116 comments (clear)

  1. Isn't there anything like sourceforge for android? by splerdu · · Score: 4, Interesting

    Se we can download source and built it ourselves?

  2. What's the world coming to by tsa · · Score: 2

    Aren't there laws against these practices?

    --

    -- Cheers!

    1. Re:What's the world coming to by migla · · Score: 1

      >Aren't there laws against these practices?

      You know, I might ask you the very same question, Mr tsa. (j/k, your probably not *that* tsa, right?)

      --
      Some of my favourite people are from th US; Vonnegut, Chomsky, Bill Hicks.
    2. Re:What's the world coming to by tsa · · Score: 1

      No, my tsa are some letters from my family name, don't worry :). I don't even live in America.

      --

      -- Cheers!

  3. duh by melikamp · · Score: 1, Flamebait

    Closed source = no expectation of security + no expectation of privacy + expectation of malice + higher development cost. The sooner Joe Q. Public gets this consumer advocacy message, the better off he'll be. There are only two valid reasons to conceal the code: embarrassment and ill will towards the user. And the only valid reason to make an open-sourced program non-free is greed. None of these are helping the user, the consumer, or whatever you want to call 99% of people who use computers.

    1. Re:duh by Anonymous Coward · · Score: 1

      I think it's unfair to say that a desire to make money off of your product is greed, if greed is bad.

      There are two options here:
      1. Your statement is false, and someone who puts _their_ time and effort into a product has a right to be compensated for their time and effort. Thus by charging for a product, they are not greedy by definition. They need to make a living too.

      Or

      2. Your statement is true, and greed is not bad.

      I think it's the former. While I certainly use my fair share of free software (and enjoy it), I find that a lot of people in the open-source community feel an arrogant sense of entitlement. They believe that they are entitled to another person's work for free. They seem to ignore the fact that developers need to make money off of their product if they want to make a living off of it. Otherwise, the software just becomes a little side project, and doesn't get the attention it needs.

      That's not to say I don't support the open-source community whole-heartedly, and contribute to it when possible. However, bashing developers who want to make a living off of their products is unfair.

    2. Re:duh by melikamp · · Score: 1

      People who flex the copyright muscle to keep their software non-free are greedy. They would like to collect monopoly profits, and the cost we are all paying is that the software cannot be improved by volunteers (even if the source is open, that is, can be built with free tools, improvements cannot be shared). I have no problem with monetizing software in a way that keeps the software free. More than 99.9% of all commodity software users are just that: users, and we all get shafted by intellectual monopolies. If we are going to pay for software development, we should pay for free software development, since it is cheaper for us, and results in software that does what we want it to do, and nothing else.

    3. Re:duh by MobileTatsu-NJG · · Score: 1

      ...+ higher development cost...

      Higher development costs don't matter until the profit is counted. If you give it away and don't charge, then your development costs are actually higher with Open Source.

      Basically you shot your own argument in the foot.

      --

      "I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)

  4. Powers by Kamineko · · Score: 1

    I was really suprised when I learned how blunt the security options in Android were.

    I'm used to COMODO IS asking me every time an application attempts to use TCP/UDP, start another process, look at a DLL or stuff like that.

    All you get on Android is 'DO YOU WANT APPLICATION TO INTERNET? Y/N' which is totally insufficient.

    1. Re:Powers by Anonymous Coward · · Score: 2, Insightful

      Yeah, you have fun with that crap. I prefer to use the device instead of auditing every packet and process it produces.

    2. Re:Powers by Chapter80 · · Score: 1

      I think "Yes, No, or Prompt me each time" would work.
      Then when you get prompted, it should offer the opportunity to never ask again.

      I, too, was shocked that when you install an app on the Android, you get one opportunity to see the permissions that you are granting that app. Seemed like it was "take it or leave it", too - you can give it all the required permissions, or not use the app.

    3. Re:Powers by Rich0 · · Score: 1

      Agreed - you should be able to tweak the permissions. So, if the app asks for location tracking, and you don't want to grant it, you can tell the OS to install the app but not let it know the location, rather than not install it at all. Of course, if you're installing a navigation app you'll have to accept that the app won't work. However, if you're installing an IM client maybe you don't want it to know where you are.

      The API could make these kinds of situations work out so that applications don't have problems. If the app asks for a location just feed it someplace random. If an App asks for phone numbers give it some Obama's cell phone number, or whatever. In fact, bonus points if the OS lets you pick what kind of garbage you feed the app.

      App makers will be less prone to pulling these kinds of stunts when all it does is corrupt their marketing databases.

    4. Re:Powers by Lusa · · Score: 1

      All I want is for the android platform to distinguish internet access for it's purpose. ie, have a permission that says this app shows adverts or another for collects usage stats. These would then have limited access to some websites already preconfigured or even restricted to Google or the phone provider/carrier. Then if this is part of the API the phone can control what information is allowed through, even restrict the granularity of information (ie, age groups, or country rather than city). I'm happy if the app is honest with its intentions, then I'm more likely to trust and use it.

  5. Information security? by Wowsers · · Score: 1

    Now, apart from the phone ID, do people REALLY use their real age, gender, and postal code on their phone? It's your phone, not the advertisers. It also sounds like we need a web browsers "No script" type of app for Android to trawl the other apps for data leaks and deliberately ruin the data for advertisers. They are not paying your phone bill, so why give them useful information, give them garbage.

    --
    Take Nobody's Word For It.
    1. Re:Information security? by icebike · · Score: 2, Insightful

      This is actually a good Idea.

      The problem is that giving that level of snooping capability to one app pretty much makes it available for other apps, and you can see how that would get out of hand pretty quickly with one app data mining another and sending back encrypted data later.

      Perhaps a better method would be for Android/IOS to find a way to lock down access to specific items of data in the phone. If you want to deny an app from reading your phone number or IMEI you can just uncheck a box and it can't even call the APIs that do that. You might end up killing off app functionality, but at least you would know when some game decided ti email your addressbook to china or something.

      This pretty well has to be solved at the system level rather than at the level of a watchdog app.

      --
      Sig Battery depleted. Reverting to safe mode.
    2. Re:Information security? by RobbieCrash · · Score: 1

      While not a complete block of all this garbage, adFree on rooted Android phones blocks most ads at the /etc/hosts level, and I'm sure lots of these companies aren't writing code to submit directly to IP address.

      I can't imagine them writing a way to get my info, but not show me their ads, and since installing, all of my "ad-supported" apps are not.

      I have no issue paying for apps, and will continue to do so if I find it useful. But garbage like this is going to prevent me from doing any form of proxy support for developers.

      --
      Keep on knockin'
      https://robbiecrash.me
    3. Re:Information security? by DrEldarion · · Score: 1

      They are not paying your phone bill, so why give them useful information, give them garbage.

      No, they're paying for the apps you're using, though. If you don't like this information being used, don't use the apps that collect it. When you go to install an Android app, it clearly tells you what permissions the app asks for. If you see something you don't like, you can cancel the installation.

  6. In other news by countertrolling · · Score: 1

    It was uncovered today that your toilet analyzes your stools and sends the results to your proctologist. If you cannot afford a proctologist, one will be provided to you...

    --
    For justice, we must go to Don Corleone
    1. Re:In other news by Anonymous Coward · · Score: 3, Funny

      It was uncovered today that your toilet analyzes your stools and sends the results to your proctologist. If you cannot afford a proctologist, one will be provided to you...

      unless you live in the US. in which case, your shit's out of luck

  7. Re:Isn't there anything like sourceforge for andro by kanto · · Score: 1

    Does sourceforge have a policy of discrimination against mobile stuff? Also, downloading and compiling is only useful when someone has done the coding and sharing.

  8. Ugh by alvinrod · · Score: 4, Insightful

    Sorry to burst your bubble, but most developers like to eat, which means that commercialization of software comes in at some point, whether that's advertising, support, or something else. Limiting the selection of software to only non-free (as in beer) software would result in a lot less software being available (or made in the future), which isn't exactly helpful for end users either. FOSS has gone a long way to make the world a better place, but it's not a be-all, end-all solution.

    1. Re:Ugh by migla · · Score: 2

      >FOSS has gone a long way to make the world a better place, but it's not a be-all, end-all solution.

      Sure it is. We're just not there yet.

      --
      Some of my favourite people are from th US; Vonnegut, Chomsky, Bill Hicks.
    2. Re:Ugh by Anonymous Coward · · Score: 1, Insightful

      Because maybe he agrees that the developers should be fairly paid for their work? Not everyone is a retarded hippie, okay? Knock it off. You're the spineless one if you can't accept that people think differently than you about how software should be available. I personally am perfectly fine with applications that are closed and applications that are open, as long as there aren't inherent problems with the closed software (shady company, obvious lack of maintenance and support, etc.)

  9. I think many people suspected this by Gonoff · · Score: 1

    There are many applications that want to run more services that they need to.
    For example, when I start up an application for an IT magazine, it always asks me if I want to turn on my GPS. There is no need for it to use GPS to show me content so the only reason would be to make a not of my location for someone else.

    That is an easy one to fix, I have GPS off unless I anctually want to use it. The same goes for WiFi - smartphone batteries do not last as long as stupidphone ones.

    But what about other leaks?
    Limit yourself to open source apps - ideally write them yourself. Never use anything free and closed source. You never know what is there!

    I just consider my phone an insecure device and do not trust it. I do not do anything on it that involves confidentiality. I also do not respond well to unsolicited adverts...

    --
    I'll see your Constitution and raise you a Queen.
    1. Re:I think many people suspected this by Rich0 · · Score: 1

      Yup. All of your problems would go away if the app asked for a list of permissions, and then you'd edit them to what you want to give. Obviously you can't revoke GPS since you'll get no value from the app, but you could just kill the network access.

    2. Re:I think many people suspected this by GIL_Dude · · Score: 3, Informative

      Don't forget that Assisted GPS (A-GPS) requires network access: http://en.wikipedia.org/wiki/Assisted_GPS. Some of these folks may have just been trying to get you a correct fix faster by using A-GPS. Unfortunately, you can't tell from the Android permissions screen as you will just get things like "network access" which can be used for any purpose - benign, nefarious, or anything in between. I don't know what the answer is to this, but I know I would prefer to be able to tell the app what sites / services it could access.

    3. Re:I think many people suspected this by Gonoff · · Score: 1

      Do it over WiFi and check it out on your router.

      --
      I'll see your Constitution and raise you a Queen.
    4. Re:I think many people suspected this by Anonymous Coward · · Score: 1

      An application on Android can get location information using A-GPS without using network permissions, the "assisted" segment is handled by the GPS daemon\driver.

  10. BlackBerry Permissions by egranlund · · Score: 1

    I know on my Blackberry whenever I install apps it gives me a list of permissions the app is asking for and I have to either approve or deny the permissions. There has been more than one occasion where I've gone back and fourth with a app developer after their app refused to run without having access to my contacts, gps coords and other things. I believe the last one I encountered this with was a freaking flashlight application. Doesn't Android/iPhone have this type of thing when apps are installed?

    1. Re:BlackBerry Permissions by SilentChasm · · Score: 2

      Android does. It will display a list of things it needs to access, like device state/network access/ability to turn off autosuspend/etc. Ebook readers for example need to be able to prevent the screen from turning off. Messaging apps need network access. Etc. They are usually inflated from what you think the app should need though. Some are just insane with the permissions they want.

    2. Re:BlackBerry Permissions by mattncsu03 · · Score: 1

      Android is not the same, check out the screen shots posted in this forum link: http://forums.crackberry.com/f86/application-permissions-234021/ The BB actually gives the user the choice on a PER-APP basis what permissions to allow each app. As much as I've grown to hate my BB Storm for its overwhelming lack of memory and frequently required battery pulls, at least I have some control over how applications use my phone. I'd love to switch to an Android-based phone but I am hoping that the developers will address this issue first .

    3. Re:BlackBerry Permissions by cynyr · · Score: 1

      yes but i cannot selectively disable parts of the permissions it is requesting.

      --
      All of the above was encrypted with a Quad ROT-13 method. Unauthorized decryption is in violation of the DMCA.
    4. Re:BlackBerry Permissions by netsharc · · Score: 1

      But on a BlackBerry you can permit/deny individual items, whereas on the Android, you can either permit all or deny all (by not installing the app). Which is a useless security model, the user will think "Oh it will steal all my data. But I really want to play this game!".

      On the BB you can say "Sure you can keep the screen powered on, but no internet, no location, no reading the calendar and address book."...

      --
      What time is it/will be over there? Check with my iPhone app!
  11. New SMS Message! by Anonymous Coward · · Score: 1

    Hey! You just walked by the best pizza restaurant in town! Come on in, show this message at the check-out, you'll receive a 10% discount. We're just 102.1 meters away at 3030 Main St.

    1. Re:New SMS Message! by Anonymous Coward · · Score: 1

      Yeah, my god, you think humans are capable of walking the length of a football field? It takes incredibly trained football teams many tries with rest periods to make it that far!

  12. Well duh... by Timmmm · · Score: 1

    Anyone who has used android knows this is true. There are loads of apps that ask for permissions they clearly shouldn't need. Most often it is for internet access, your location, your phone ID (IMSI), and sometimes access to your contacts.

    Obviously the crappy little 'content' apps like DailyHoroscope, backgrounds and ringtones are the main culprits.

  13. Re:Isn't there anything like sourceforge for andro by beakerMeep · · Score: 2

    For the Android OS there is: The Android Open Source Project

    However, as far as I understand it, there are some hurdles with regards to building a ROM depending on the phone you have. Some have locked bootloaders / proprietary drivers.

    For apps, there is a lot of stuff on GitHub, but as someone else already posted that requires the dev to have shared the code.

    If you root your device a good firewall is DroidWall

    --
    meep
  14. Re:Does Android have a hosts file? by Mordok-DestroyerOfWo · · Score: 1

    Just search for AdFree

    --
    "Never let your sense of morals prevent you from doing what is right" - Salvor Hardin
  15. So why buy an android or jobsian phone? by Rhodri+Mawr · · Score: 2

    ...when you could have a Nokia N900?

    1. Re:So why buy an android or jobsian phone? by Culture20 · · Score: 1

      ...when you could have a Nokia N900?

      I bought an iPhone 4 recently (previously used a 1st gen iPhone). The choice was between it an an n900. N900 was winning on all counts except ease of upgrade (which was not a major factor at all). N900 lost when I went to a local store and saw the thickness of the n900. My pocket space is valuable.

  16. Unique Id by igreaterthanu · · Score: 1

    So if an app just happened to transmit a unique id then it would get on this list?

    I don't see how that is much of an issue at all, remember your browser can identify you uniquely unless you have something as common as a fresh install of XP with no updates, etc.

    I would like to see the figures that have better criteria than just sending unique ids. (Such as location)

    --
    I dream of a nation where a man is not judged by his skin color but by an number assigned by a credit rating agency.
  17. Data from Article by scruffy · · Score: 5, Informative
    Here is a list of the apps and the information they send about you. Explanation of the columns and numbers are on the bottom of this message. The extra annoying text is to get around the GDF lameness filter.

    A B C D E F IPhone App the quick brown fox jumped over the lazy dog
    0 0 0 0 2 0 0.03 Seconds Pro the quick brown fox jumped over the lazy dog
    0 0 0 0 2 0 Age My Face the quick brown fox jumped over the lazy dog
    2 2 0 2 2 0 Angry Birds the quick brown fox jumped over the lazy dog
    2 0 0 2 2 0 Angry Birds Lite the quick brown fox jumped over the lazy dog
    1 0 0 2 2 0 Aurora Feint II: Lite the quick brown fox jumped over the lazy dog
    0 0 0 0 2 0 Barcode Scanner (BahnTech) the quick brown fox jumped over the lazy dog
    2 0 0 0 0 2 Bejeweled 2 the quick brown fox jumped over the lazy dog
    0 0 0 2 2 0 Best Alarm Clock Free the quick brown fox jumped over the lazy dog
    0 0 0 2 2 0 Bible App (LifeChurch.tv) the quick brown fox jumped over the lazy dog
    0 0 0 0 0 0 Bump the quick brown fox jumped over the lazy dog
    0 0 0 2 2 0 CBS News the quick brown fox jumped over the lazy dog
    0 0 0 0 2 0 0.03 Seconds the quick brown fox jumped over the lazy dog
    0 0 0 2 2 0 Dictionary.com the quick brown fox jumped over the lazy dog
    2 0 0 0 1 0 Doodle Jump the quick brown fox jumped over the lazy dog
    1 0 0 1 1 0 ESPN ScoreCenter the quick brown fox jumped over the lazy dog
    1 1 0 1 0 0 Facebook the quick brown fox jumped over the lazy dog
    0 0 0 0 0 0 Flashlight (John Haney Software) the quick brown fox jumped over the lazy dog
    0 0 0 1 2 0 Fluent News Reader the quick brown fox jumped over the lazy dog
    1 0 1 2 0 1 Foursquare the quick brown fox jumped over the lazy dog
    0 0 0 2 2 0 Fox News the quick brown fox jumped over the lazy dog
    2 0 0 2 0 0 Google Maps the quick brown fox jumped over the lazy dog
    1 0 2 2 2 0 Grindr the quick brown fox jumped over the lazy dog
    2 0 0 1 2 0 Groupon the quick brown fox jumped over the lazy dog
    0 0 0 0 2 0 Hipstamatic the quick brown fox jumped over the lazy dog
    0 0 0 0 2 0 iJewels the quick brown fox jumped over the lazy dog
    0 0 0 0 0 0 iLoveBeer: Zythology the quick brown fox jumped over the lazy dog
    1 0 0 1 2 0 Medscape the quick brown fox jumped over the lazy dog
    1 0 1 2 2 0 MyFitnessPal the quick brown fox jumped over the lazy dog
    1 0 0 1 1 0 Netflix the quick brown fox jumped over the lazy dog
    0 0 0 2 2 0 NYTimes the quick brown fox jumped over the lazy dog
    0 0 0 2 2 0 Ninjump the quick brown fox jumped over the lazy dog
    0 0 2 2 2 0 Pandora the quick brown fox jumped over the lazy dog
    0 0 0 2 2 0 Paper Toss the quick brown fox jumped over the lazy dog
    0 0 0 0 0 0 PerfectPhoto the quick brown fox jumped over the lazy dog
    0 0 0 2 2 0 Pimple Popper Lite the quick brown fox jumped over the lazy dog
    0 0 0 2 2 0 Pumpkin Maker the quick brown fox jumped over the lazy dog
    0 0 0 0 1 0 RedLaser the quick brown fox jumped over the lazy dog
    0 0 0 0 2 0 Ringtone Maker the quick brown fox jumped over the lazy dog
    2 0 0 0 2 0 Ringtone Maker Pro the quick brown fox jumped over the lazy dog
    0 0 0 2 2 0 Shazam the quick brown fox jumped over the lazy dog
    2 0 0 2 2 0 Talking Tom Cat the quick brown fox jumped over the lazy dog
    1 1 2 2 2 1 TextPlus 4 the quick brown fox jumped over the lazy dog
    0 0 0 2 2 0 The Moron Test the quick brown fox jumped over the lazy dog
    0 0 0 0 2 0 The Moron Test: Section 1 the quick brown fox jumped over the lazy dog
    0 0 0 2 2 0 Tips & Tricks: IPhone Secrets Lite the quick brown fox jumped over the lazy dog
    2 0 0 2 0 0 TweetDeck the quick brown fox jumped over the lazy dog
    0 0 0 0 1 0 WSJ Mobile Reader the quick brown fox jumped over the lazy dog
    0 0 0 2 2 0 The Weather Channel the quick brown fox jumped over the lazy dog
    0 0 0 0 0 1 WhatsApp Messenger the quick brown fox jumped over the lazy dog
    1 0 0 2 2 0 Yelp the quick brown fox jumped over the lazy dog
    1 0 0 0 0 0

    1. Re:Data from Article by cyberstealth1024 · · Score: 1

      awesome list! how did you compile this? based off of EULAs or a packet sniffer or..?

    2. Re:Data from Article by scruffy · · Score: 1

      All the information comes from links from the WSJ article. I think I got lucky with NoScript and setting various temporary permissions to get a table I could copy and eventually convince Slashdot that it wasn't lame.

  18. Re:real losers by migla · · Score: 1

    >are the ones that need to tell others what is cool and what is not

    What about those who tell others who the real losers are, what are those?

    --
    Some of my favourite people are from th US; Vonnegut, Chomsky, Bill Hicks.
  19. fake data by F�an�ro · · Score: 1

    I do not have a smartphone myself, but one of the first apps I would install would be some sort of fake data sandbox for apps.

    I have seen the install screen for android apps briefly: they show what sort of permissions an app needs: access to GPS, address book, outgoing sms, etc; but the only options seemed to be "grant that access" or "do not install"

    So simply add a checkbox that allows me to supply fake GPS data, fake "no connection" signal, fake empty address book for apps that I do not want to access these parts, but want them to run regardeless.

    Is that impossible ar particularily hard to program?

    1. Re:fake data by coolmadsi · · Score: 1

      Fake data sounds like a solution to a symtom, as opposed to a solution to the inital problem; better selection on what parts can and can't be accessed at all would be a better solution (but that may be either harder or easier than your solution)

  20. A simple solution: root the phone by dmesg0 · · Score: 1

    After rooting your Android phone, you can block the advertisers with AdFree (which a simple black list for all ad sites), or go with a more complex solution like DroidWall and only allow apps you trust to access the net. And you can easily change Android ID with aptly named Android ID changer or simple db hack.

    Not sure if something similar exists for iPhone (would never touch it anyway).

    1. Re:A simple solution: root the phone by dmesg0 · · Score: 1

      I don't mind to see the occasional ad, but I never agreed to sending my personal information to the advertisers. It is not essential to them, the targeted ads don't seem to work anyway despite all their efforts (I don't remember any mobile ad that seemed even little relevant).

      Since it's the app developers who send the information, they deserve to be left without revenue. Maybe it'll teach them to value their users' privacy.

    2. Re:A simple solution: root the phone by tlhIngan · · Score: 1

      After rooting your Android phone, you can block the advertisers with AdFree (which a simple black list for all ad sites), or go with a more complex solution like DroidWall and only allow apps you trust to access the net. And you can easily change Android ID with aptly named Android ID changer or simple db hack.

      Not sure if something similar exists for iPhone (would never touch it anyway).

      Yep, also for jailbroken ("rooted") iPhones. It's called Firewall IP and alerts you to all outgoing connections being made. Since ad servers are usually obvious, the ipfw rule is modified to block that connection.

      The most annoying part is all these utilities seem to require rooting your phone in some way (rooting and jailbreaking are effectively equivalent operations in the end. We call it jailbreaking on iPhone because the original jailbreaks are used to break out of the chroot-like jail iOS runs apps in. And i guess we call Android "rooting" since "jailbreaking" implies something is closed ("Android is open!", no, it's open-source). Both get you root prompts in the end (iOS apps run under a user account as well)).

      Is there sn Android equivalent to manipulating the firewall?

    3. Re:A simple solution: root the phone by dmesg0 · · Score: 1

      What's your app, and what kind of ads do you use? And why are you AC?

      I use DroidWall and have a few simple rules for allowing or disallowing net access. First, all apps are denied 3G access unless they really need it (my data plan is limited). Second, if an app requires some suspicious permissions - it is denied Wi-Fi access as well. For instance, if an offline game requires location information (and a lot do!) - it is denied any kind of net access.

    4. Re:A simple solution: root the phone by dmesg0 · · Score: 1

      In Android all apps get different UIDs (unless they demand sharing the id), and GID determines the allowed permissions. So it's very easy to filter not just by usual IP rules (src:port-dest:port), but also by application, effectively doing application level firewall. That's what DroidWall is.

      There is a huge difference between rooting and jailbreaking. Android is open, in a sense that it allows installing apps from any source out of the box, you don't need jailbreaking. Rooting just allows superuser permissions to some apps, and you explicitly control which ones and when to give them root access. Very few apps need root and always for a very good reason (in 2.2+ at least. In 2.1 rooting was required to control LED flash, which wasn't a good reason, so Google fixed it).

      .

  21. Android sandboxing by owlstead · · Score: 1

    Don't forget that Android applications are placed in a sandbox. Each time you install an app, you will have to agree that the app wants to have access to specific parts of your phone. I've discarded apps that were too invasive, e.g. wanting access to my phone book, or games that want access to the internet. With Apple, the only protection you have is...Apple. At least with Android there is another level of security.

  22. Re:Isn't there anything like sourceforge for andro by asnelt · · Score: 2, Informative
    I'm not aware of a repository but there are three lists of Android free software apps that I know of.

    Le Wiki Koumbit: https://wiki.koumbit.net/AndroidFreeSoftware

    The Replicant for Android list: http://trac.osuosl.org/trac/replicant/wiki/ListOfKnownFreeSoftwareApps

    The Wikiperdia list: http://en.wikipedia.org/wiki/List_of_Open_Source_Android_Applications

  23. Laws of reality by SuperKendall · · Score: 4, Informative

    The article stated:

    "One iPhone app, Pumpkin Maker (a pumpkin-carving game), transmits location to an ad network without asking permission."

    That is flat out impossible. I am an iPhone developer; there is no way for an application to obtain user location without the user being prompted if that is OK.

    It makes the rest of the conclusions very suspect to me. Just how would an app get age and gender? Again I cannot think of a way that is even possible on an iPhone without being asked; no-where on my iPhone is my birthday or age stored.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
    1. Re:Laws of reality by R3d+M3rcury · · Score: 4, Insightful

      The problem is, there is no way to know what the information is being used for.

      I've never used Pumpkin Maker and the description doesn't mention anything about it's capabilities. However, suppose I include a "feature" which will display a background depending on the time of day and your location. So if it's after sunset, it will be dark outside. Of course, for me to know if it's sunset, I need to know your location since sunset varies depending on where in the world you are.

      Thus, Pumpkin Maker needs my location. So it comes up and says, "Would you like to allow Pumpkin Maker to access your location?" Makes sense--it needs to know my location so that it can display the appropriate background. Of course, it doesn't mention that while it's showing your appropriate background, it's sharing your location with it's advertisers.

      Gender would be easy to come by--just ask. After all, it's a fun game for kids and we want to identify the kid with the appropriate pronoun. Or we ask for a name and send that off--after all, we want to identify your pumpkin as "Bob's Pumpkin" or "Sally's Pumpkin" initially, right? Then something on the backend figures out that "Bob" tends to be a boy's name and "Sally" tends to be a girl's name. "Pat" will confuse it, of course...

      Age? Again, you could just ask. You have a collection of add-ons for your pumpkin and you want to filter for age-appropriateness. After all, we don't want small children adding pumpkin boobies or penises. That would be sick and wrong and we're a good company that Thinks of the Children.®

      So the game collects all of this information for a good reason but it never says, "Hey, you mind if I ship it off to advertisers?"

      Again, I've never used this App. I don't know much about it. But these are some ways you could get the information.

    2. Re:Laws of reality by R3d+M3rcury · · Score: 2, Interesting

      Oh, I agree, there isn't one.

      Part of the problem, though, comes from the iPhone zealots--and, to a lesser degree, Apple--who claim that Apple's App Store makes your private information nice and secure. After all, they'll claim, look at all those nasty apps on Android that transmit your personal information. iPhone users don't have to worry about that because Apple checks all of these things and makes sure that you're safe.

      So if Apple can't stop an App like Pumpkin Maker from transmitting personal information, what is the advantage to the customer of having a sole-source App Store? Isn't Apple just providing "security theatre" by implying they can do things that they obviously cannot?

    3. Re:Laws of reality by kenshin33 · · Score: 1

      did you actually read his post, or it a knee jerk reaction???
      he's replying with a hypothetical (and also plausible) way of obtaining information which the GP was say is impossible without the user's consent.
      in his scenario he's saying that it is possible that the application asked for that information in order to function as advertised but no where it says hey while we're here I'll be shipping the information that you just gave to [insert add company]. Which is very plausible. If the application would ask may some people may be wont give that information and, some may be wont bother with the application at all, and or some might and buy the full/pro/or whatever version without the ads version if it ever existed.

    4. Re:Laws of reality by yesiree · · Score: 1

      The article stated:

      "One iPhone app, Pumpkin Maker (a pumpkin-carving game), transmits location to an ad network without asking permission."

      That is flat out impossible. I am an iPhone developer; there is no way for an application to obtain user location without the user being prompted if that is OK.

      It makes the rest of the conclusions very suspect to me. Just how would an app get age and gender? Again I cannot think of a way that is even possible on an iPhone without being asked; no-where on my iPhone is my birthday or age stored.

      On my Android for example you can cross link contacts from different sources. Facebook for example. On Facebook you could store your birthday and gender. I am not a developer, but I see some possibilities here perhaps... Any comments?

    5. Re:Laws of reality by JAlexoi · · Score: 1

      Can it get access to Facebook app's info? For age, sex and more info?
      Can it get the cell tower ID or some other non-obvious metric identify location?

    6. Re:Laws of reality by SuperKendall · · Score: 1

      You'd still have to be asked for the users Facebook login credentials. The user would then know the app had access to Facebook data - and I believe that Facebook further tells you what kinds of data the application has requested access to see.

      From there it is possible for the app to mine something and send it off. But, again, the user would know the app had access to Facebook, they had authorized it. And Apple does some kind of network monitoring from apps to see what they are transmitting, so if it did that they may well see it sending out users data and reject it. At the very least if it were brought to Apple's attention they could reject it.

      --
      "There is more worth loving than we have strength to love." - Brian Jay Stanley
    7. Re:Laws of reality by pariax · · Score: 1

      "One iPhone app, Pumpkin Maker (a pumpkin-carving game), transmits location to an ad network without asking permission."

      That is flat out impossible. I am an iPhone developer; there is no way for an application to obtain user location without the user being prompted if that is OK.

      It makes the rest of the conclusions very suspect to me. Just how would an app get age and gender? Again I cannot think of a way that is even possible on an iPhone without being asked; no-where on my iPhone is my birthday or age stored.

      Impossible? Anything's possible. http://blogs.wsj.com/digits/2010/12/19/how-one-apps-sees-location-without-asking/

  24. Some of what the article stated is not possible by SuperKendall · · Score: 1, Interesting

    The article stated:

    "One iPhone app, Pumpkin Maker (a pumpkin-carving game), transmits location to an ad network without asking permission."

    That is flat out impossible. I am an iPhone developer; there is no way for an application to obtain user location without the user being prompted if that is OK.

    It makes the rest of the conclusions very suspect to me. Just how would an app get age and gender? Again I cannot think of a way that is even possible on an iPhone without being asked; no-where on my iPhone is my birthday or age even stored.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
  25. yeah and? by josepha48 · · Score: 1
    This isn't new information. This has been known for a while.

    You buy an android and you pretty much HAVE to have a google account so all your data can be 'in the cloud'. If it has moto blur then moto has a copy too.

    You install facebook on your iphone, blackberry, android or whatever and then all your contacts are on your phone and 'in the cloud'. Most of the apps that are free have ads and it is pretty standard practice for advertisers to want as much info about someone as possible. This is not anything new and it has been known for a while on these devices.

    You can write your own apps, but good luck with that, start an open android market, but then you can have all sorts of rogue apps taking who knows what kind of data about your computer or you can live with this.

    The same thing happens online when you visit a web site, only they use cookies and try to gather as much info as possible. I suppose at some point google or the android community or apple will add in an anonymous feature on the phones, but until then you either live with it or don't get a smart phone.

    --

    Only 'flamers' flame!
    Does slashdot hate my posts?

  26. Gender? by izomiac · · Score: 1

    So, since I can't recall ever supplying my gender to my phone, how is it determining that? Turning on the camera, hoping there's a hole in my pocket, and assuming that my sex and gender are concordant? Snooping on my location and contacts is one thing, but if I volunteer certain information then I've always assumed the app phoned home with that information. Surely that's common sense...

  27. Re:Isn't there anything like sourceforge for andro by hunangarden · · Score: 1

    Right, what the heck is the purpose of obtaining the source? So you can spoof your location? That will work well when you actually want to use a GPS app for real. No spy code in OS, the spy code is in 3rd party libraries that developers put into their code for Ads and Analytics.

  28. A wonderful new tool by AHuxley · · Score: 1

    http://www.usatoday.com/tech/news/2010-12-13-army-smartphones_N.htm?csp=34tech
    The [US] Army wants to issue every soldier an iPhone or Android cellphone — it could be a soldier's choice.
    Vane said he wants to use the phones to collect biometrics on enemy combatants.
    To track the bad guys, track the troops and what the troops might be writing about.

    --
    Domestic spying is now "Benign Information Gathering"
  29. Your Apps Are Watching You by pickens · · Score: 1

    An investigation by the Wall Street Journal of 101 popular smartphone "apps"--games and other software applications for iPhone and Android phones--shows that 56 transmitt the phone's unique device ID to other companies without users' awareness or consent. Forty-seven apps transmitt the phone's location in some way. Five send age, gender and other personal details to outsiders. "In the world of mobile, there is no anonymity," says Michael Becker of the Mobile Marketing Association. A cellphone is "always with us. It's always on." Smartphone users are all but powerless to limit the tracking. With few exceptions, app users can't "opt out" of phone tracking, as is possible, in limited form, on regular computers. Both Apple and Google say they protect users by requiring apps to obtain permission before revealing certain kinds of information, such as location but the investigation found that these rules can be skirted. For example, one iPhone app, Pumpkin Maker (a pumpkin-carving game), transmits location to an ad network without asking permission. Apple declines to comment on whether the app violates its rules.

  30. Re:Isn't there anything like sourceforge for andro by kenshin33 · · Score: 1

    Define all the 3rd parties library functions as dummies and rebuild without linking to those libraries ...

  31. This is why I don't include ads in my apps... by markana · · Score: 1

    All of my Android apps are either free, or one-time paid. Sure, I could probably make some more money bundling in an ad network, but who wants to be responsible for exposing my customers like that? Besides, some of my apps are designed to *enhance* privacy - I could hardly turn around and sell out my users. The developer who includes ads in their app has little, if any, control over how the collected data will be used or disseminated. So for me, it's just too much of a risk.

  32. Re:I, for one, by rjch · · Score: 1

    I, for one, would like to invite our new advertising overlords to take a flying f..k. But that's just me.

  33. We've been here before by McD · · Score: 1
    From TFA:

    Among all apps tested, the most widely shared detail was the unique ID number assigned to every phone. It is effectively a "supercookie," says Vishal Gurbuxani, co-founder of Mobclix Inc., an exchange for mobile advertisers.

    On iPhones, this number is the "UDID," or Unique Device Identifier. Android IDs go by other names. These IDs are set by phone makers, carriers or makers of the operating system, and typically can't be blocked or deleted.

    "The great thing about mobile is you can't clear a UDID like you can a cookie," says Meghan O'Holleran of Traffic Marketplace, an Internet ad network that is expanding into mobile apps. "That's how we track everything."

    Anybody else remember twelve years ago, when Intel started putting serial numbers in CPUs? There was widespread outrage, and they dropped the idea.

    Today, Google and Apple have (effectively) put serial numbers in (handheld) computers, and software is rabidly exploiting that.

    We didn't tolerate it then, we shouldn't tolerate it now.

    --
    "Given the pace of technology, I propose we leave math to the machines and go play outside." -- Calvin
  34. It's rough out there by kakris · · Score: 1

    I've written a few small games for Android. They're all free and ad supported, and the advertising networks want as much data as they can get. Even with all that, they don't pay all that well. One of my apps gets as little as $.16 per 1,000 ad impressions. I'd love to skip the ads, but my apps really aren't good enough to charge for, at least this way I get something out of it. It's not like the developers are getting rich on your personal data, perhaps the networks are or developers who are lucky enough to get a lot of exposure, but it's a rough world for the little guys looking to compete. I'm glad it's just a hobby for me.

  35. Still consented to by user by SuperKendall · · Score: 1

    It doesn't matter what the app does with the location data after, the fact is that you agreed to provide it. The poster you are responding to is exactly correct that it's kind of a social engineering issue, although depending on what you are sending Apple might actually catch it in review (remember that now they are checking for things like device specific data being sent out thanks to leaked device testing details).

    At least on the iPhone you are asked when the app tries to get the users location, not up front as on Android.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
    1. Re:Still consented to by user by kenshin33 · · Score: 1

      Agreeing or not to give the information depends on what the intended purpose of asking/using. I walk in bar they ask me for an ID to let me in (which is normal to check if I'm old enough). that's not carte blanche to share that info with whom they want. So Yes what the intend to do with that info matters. And if the dev ignores that he's an ass.
      But that's beside the point. The poster who answered your post didn't in any way intended to propose a solution for the social eng problem he was merely pointing out to it (giving a scenario where it is possible to get the information).
      And there is no at least. Android has its pros and its cons as do the IPhone this nor the place nor the time to start a flameware on what platforn is better.
      In this case both did it wrong. Android by it's pseudo openness opens the door to any crap. you're at the mercy of the dev. And the IPhone with it's closure, you're at the mercy of what ever apple decides to do about it.

  36. No. by SuperKendall · · Score: 2

    Can it get access to Facebook app's info? For age, sex and more info?

    No, app sandbox.

    Can it get the cell tower ID or some other non-obvious metric identify location?

    Not in the API and therefore would be rejected. You also cannot get the SSID of the WiFi you are on nor any WiFi around you.

    As I said, I'm an app developer. I know the sneaky ways you could try and do something, and what is possible. Gender is not even stored anywhere. Location is just not possible with the restrictions the app store has in place (and they are scanning now for any use of private symbols).

    Not to mention they are ALSO monitoring outbound connections from apps now as part of review.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
    1. Re:No. by Xest · · Score: 1

      Can apps access the web without permission? IP based location over HTTP is trivial and if web access doesn't require special permission then that's one way to do so.

      It is of course much less accurate than GPS based location.

  37. Re:What idiot comes up with this stuff? by GORby_ · · Score: 1

    Then clearly I must be an Android person, because you sir, are not making sense to me at all...

  38. Trivial? by SuperKendall · · Score: 1

    IP based location over HTTP is trivial

    Quick, what is the location of 10.1.10.45? That's my current IP address.

    But perhaps you'd proclaim NAT to be unfair even though 90% of people on WiFi will be behind one.

    Well what about the cell network? My phone is 166.205.14.227.

    And I don't live anywhere near Austin, or even in Texas...

    I wouldn't say "less accurate", I'd say "almost unusable".

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
    1. Re:Trivial? by Xest · · Score: 1

      Of course in some cases it can be states out, but even if it gives the users country, which, in 99.99% of cases it will, then that's good enough for many advertisers as they'll often have a focus across at least a whole nation with their product/advertising program. Some sites such as the BBC and Hulu trust it enough country-wise that they use it as their core method of ensuring content is only served to users in specific countries- it's trivial to get around with VPN but again, how many people do that really? It's valuable to advertisers and market research folk that's the point.

      But I'll take it from that that IP geolocation is in fact a method of gaining a users location (however rough) without any permissions in an iPhone app? I'm not attacking the platform, I know you're a massive fan of it, it's just curiosity, this is something that effects all platforms regardless really.

      I also agree that if people are conflating this sort of information that's useful to advertisers with general creepy stalker style GPS location tracking then they're being unfair. They are of course two very different things.

  39. Re:Isn't there anything like sourceforge for andro by hunangarden · · Score: 1

    No, the 3rd party libraries are what you (the developer) added to your code for ads and analytics. Its not in the source.

  40. Re:Isn't there anything like sourceforge for andro by kenshin33 · · Score: 1

    how is not in the source??? you have to call the functions at some point? and in order for the program to work as a whole you have to link against those libraries. If you look in the source and find those calls, disable them (plenty of ways to do that) and rebuild the program, the final build shouldn't have ant ads in it.
    that would be a little unethical, by doing so you deprive the dev of income. But if he shares infos he's not supposed to share, he deserves that in a way. But the best thing to do is to stay away from those applications
    Transparency is the key, if they ask for information they should tell exactly what they intend to do with it be fore you agree to give it or not. As I said in an other post, if you go to a bar and they ask for an id, you have to give the ID in order to get in (or not but you wont get in), but that doesn't give them carte blanche to do anything they want with that info (drivers lic number name address aged...etc) if they tell you we want that info to validate you have the required age to enter, and we may be giving that info to our sponsors you can say no and go some where else or say hey what the hell I don't mind be my guest. Knowing helps you make a choice (free information is key to free market)