Pandora App Sends Private Data To Advertisers

Trailrunner7 writes "An analysis of the popular free mobile application from online music service Pandora.com that is the subject of a grand jury investigation into loose data privacy practices in the mobile application market confirms that the application silently sends reams of sensitive data to advertisers. The analysis was conducted by application security firm Veracode and found that Pandora's free mobile application for Android phones tracked and submitted a range of data, including the user's gender, geographic location and the unique ID of their phone, according to an entry on Veracode's blog."

Comments

As I said last time

[Anonymous Coward]

As I said last time, "I stopped using their app when it wanted access to the system logs. This includes all notifications of pretty much everything going on on your phone. It might help them debug the app, it might help them with advertisers. Who knows. I just knew their app wasn't worth it."

This is potentially a much more massive problem than we have been told.

Re:As I said last time

[Anonymous Coward]

thank god you said that, and then repeated it again today.
 
what would we do without you!?

Re:As I said last time

[Creepy]

I stopped at the user agreement, which had something like "address book access"... - why the @*%& does a music app need access to my address book? And the conclusion I came to was "so it can steal all of the email addys in there and sell them to spammers." This is hardly the first app I've nixed for wanting way more access than I was willing to give it.

Re:As I said last time

[Gutboy]

Google needs to allow you to authorize specific permissions for apps, not their current 'all or nothing' system. This way you could say "Yes, you can have my position because I believe a GPS mapping system needs that, but no you can't have my address book, since a GPS system doesn't need that". Sure it would screw advertisers over, but I don't care about them. Not everything in the world needs to have advertising on it.

Re:As I said last time

[Anonymous Coward]

A friend recommended this. I tried it on my desktop. It insisted it needed to store cookies to flash. I tuned and ran like Sir Arthur from The Rabbit of Caerbannog.

Re:As I said last time

[Anonymous Coward]

They need address book access for a feature that allows you to share a station; the access is so the app can get your contacts' email when *you* initiate a request to email something. Pandora doesn't go through your contacts and does not harvest data from there.

Re:As I said last time

[DrXtreme]

This (and battery being dead in ~4hrs) is why my new Droid is going Bye Bye today and my iPhone is going back online...I should have known better than to even try that mess...It has great potential but I felt like I was using an even more evil version of win-blows....

Re:As I said last time

[gothzilla]

I went to check this out and found that their privacy policy said all this could be controlled through my privacy settings. It took a bit to find them, but when I did find the link (http://www.pandora.com/privacysettings) It said:

Server Error

We're sorry, there has been an unexpected error with our server.

Please try again, or visit the Pandora Home Page

Re:As I said last time

[Dishevel]

No.
You need to decide if you want the app with the permissions it asks for or not.
If you get a free app the app maker is free to attempt to make money. You are free to decide if you want that deal or not.
What you are not free to do is to say "But I really really want it! Give it to me my way!"

Man up. Take control of your own wants and needs and stop passing off your responsibilities onto others.

There are a shit ton of apps out there that I want. Some of them ask for things I do not want to give. Some ask for more money than I think it is worth.
That is where I have to make decisions. I do not get to log onto newegg and tell them they need to implement a system during checkout that lets me have the stuff but just decide to pay less because I do not want to pay that much for the item.

That would be stupid beyond belief.

What you are suggesting is the same exact thing. It is also just as stupid.

Re:As I said last time

[Belial6]

Every time this comes up, the Android folks say that they uninstalled Pandora when they tried to get assess to our personal data. No one talks about the data stealing on iPhones. Is that because we know they are not doing it on iPhone, or because the iPhone doesn't warn the user that the app is stealing their data.

Re:As I said last time

[npsimons]

No one talks about the data stealing on iPhones. Is that because we know they are not doing it on iPhone, or because the iPhone doesn't warn the user that the app is stealing their data.

No, it's because anyone with half a clue already knows that iPhones don't belong to the people carting them around, they belong to Apple; therefore, any info put on an iPhone automatically belongs to Apple. Probably Apple doesn't do much of anything with this info, that's not really a part of their business plan (yet), and Apple is such a control freak it probably won't let anyone else touch the data. But just wait until iPhone market share starts to seriously decline, then you will see Apple start making deals with "research firms" to "enhance the end user experience." Heck, they've already allowed devs to allow ads on their apps if they so choose.

Re:As I said last time

[Skuld-Chan]

Here's why that is flawed about this: a GPS system would need an address book - what if you want directions to someone in your address book? People also ask why GPS program would need access to the dialer? Remember that funny iPhone ad where they use google maps to find Sushi in SanFrancisco and then *call* the place up?

All that setting would do for the app maker is generate an angry call/comment from some idiot end user who didn't click on that permission... I agree it would be a cool tool for power users though.

I think a better solution for most end users would be for Google to highlight in bold red permissions that are typically not not needed in apps - like dialing numbers, sending text messages (anything that goes under the category "stuff that costs you money"), recording calls, reading system logs etc.

Re:As I said last time

[Eponymous Coward]

How do you know this? I take the position that if they can, they will.

Re:As I said last time

[Anonymous Coward]

Wuh? This is exactly how the permission system works.

Re:As I said last time

[majestic_twelve]

I can't believe how many people just accept apps regardless of what warnings pop up. I like how my Android phone would tell me which pieces of the phone an app would access. I refused to install a game that, say, wanted to access my address book. It had no reason to be there so I kicked it to the curb. On my Blackberry I don't give any app "Trusted" status and restrict GPS access to all apps except my AT&T Navigator and Maps apps and then I even restrict each app meaning, for example, if I download a game, I deny Security Data access, Email access, etc. People just need to pay attention and give a damn about their data.

Re:As I said last time

[M. Baranczak]

Until proven otherwise, it's safe to assume that all the Pandora shit behaves the same way. This includes the iOS app and the desktop app. What really pisses me off is that I actually paid for a subscription to Pandora.

Re:As I said last time

[IICV]

You know, I was about to post "there's no way that could work, it would make developing for the Android too difficult if the user can arbitrarily lock you out of the phone's features".

But then I realized that there's a very simple solution: if the user denies access, just give the app dummy data. Deny access to my GPS co-ords? Well then, whenever the app asks for location data it's told we're at the North Pole. Deny access to contacts? The app is told you only have one contact, whose name is "access denied".

Then, if the app is badly written and doesn't check, it'll just get useless data; if it's smarter, it can check the data it gets, test to see if it's the well-known dummy values, and if so prompt the user for access or something. It would be better than this all-or-nothing approach, at least.

Re:As I said last time

[MozeeToby]

No. Currently an app has a list of permissions it requires. If that list includes something you don't want that app to have access to, the only course of action is to not give the app access to anything (via not installing it). OP would like the ability to look at the list of permissions and, for example, remove Pandora's permission to view notifications and system logs without removing the rest of the permissions for the app.

I suspect that at least part of the reason this isn't easily done is for a few reasons. Obviously, the app makers aren't going to like it, since it will make advertising less effective and has the potential to generate lots of complaints when the apps don't work as advertised. Less obvious is the way apps are encrypted. I believe their permissions form part of the encryption key such that the app cannot run with more (or fewer) permissions than it was originally built for. This forms one of the central and most powerful anti-malware features of Android phones and I suspect they don't want to risk messing about with it more than they have to.

Re:As I said last time

[MrHanky]

According to WSJ, who had the an article the other day,

In Pandora's case, both the Android and iPhone versions of its app transmitted information about a user's age, gender, and location, as well as unique identifiers for the phone, to various advertising networks. Pandora gathers the age and gender information when a user registers for the service.

So I can't really see how Apple's system is all that much better. (And no, you don't need to use GPS to send location data, and neither is it used by advertisers.)

Re:As I said last time

[amRadioHed]

Any well written app already has to be able to deal with the permissions they request not being available, for instance if a user has GPS turned off, is out of network range, has no contacts stored on their phone, etc... If the app doesn't crash when I go into airplane mode then it wouldn't have a problem if I disabled its network permission.

Re:As I said last time

[gpmanrpi]

I think this is actually a very revealing comment. The iOS and Android platforms are solving problems that RIM solved a long time ago, in that you can actually control permissions in each application on a micro level instead of accepting a battery of permissions or nothing. I think these kinds of options will come with the maturity of the platforms, like cut and paste and tighter messaging integration. Unfortunately, the average user will still press accept all and call it a day, but at least offer the option. Maybe we need to really do a Public Service campaign to let people know that whether it is a walled garden or an open marketplace, companies will try to get the most that you will let them.

Re:As I said last time

[Anonymous Coward]

Google will never allow selective permission. It would eliminate all of the add ware. I certainly wouldn't grant web access permission.

Re:As I said last time

[IICV]

Any well written app...

Well, that's your problem right there, now isn't it? This change would not only affect apps written in the future, but would have to be backwards compatible with well-written apps from the past that are simply no longer updated.

Pointers to dummy, blank information is better than null pointers any day.

Re:As I said last time

[alostpacket]

Deciding if a permission is needed requires context. There is no algorithm that can figure that out. And, sans automation, you've landed squarely into human filtering & approval of apps.

Anyways, I wrote a guide about all the permissions that might be a worthwhile read for some here, and I'm always glad to get feedback/corrections/suggestions. (You can email me on the contact page).

How to be safe, avoid viruses, and find trusted apps A guide for those new to Android

Actually a user here (Thanks R* ) found my guide and dropped me an email pointing out just how dangerous the read logs permission is.

*not sure he wants his name posted

Re:As I said last time

[Anonymous Coward]

Here's why that is flawed about this: a GPS system would need an address book - what if you want directions to someone in your address book? People also ask why GPS program would need access to the dialer? Remember that funny iPhone ad where they use google maps to find Sushi in SanFrancisco and then *call* the place up?

All that setting would do for the app maker is generate an angry call/comment from some idiot end user who didn't click on that permission... I agree it would be a cool tool for power users though.

I think a better solution for most end users would be for Google to highlight in bold red permissions that are typically not not needed in apps - like dialing numbers, sending text messages (anything that goes under the category "stuff that costs you money"), recording calls, reading system logs etc.

Actually, on Android that example doesn't actually require phone call permissions. Google maps just calls out to the dialler with the number. It can't call directly, just launch the dialler with the number pre-populated. It's an extra button press to make the call, but I'd rather have it that way. It also means that if you've replaced the dialler, it uses yours instead.

I do agree with you that the current system for flagging what permissions an application required is better than doing it at run time though. It'll never be implemented as an option for power users though, because it means all apps would need to handle the permission exception gracefully, just for the minority that might use it.

Re:As I said last time

[Spaseboy]

Android users won't buy apps. This is what comes from that.

Re:As I said last time

[Anonymous Coward]

I just checked the permissions of the app:

- add or modify calendar events and send email to guests
- read contact data
- create Bluetooth connections, full Internet access
- read phone state and identity
- bluetooth administration
- change network connectivity
- change Wi-Fi state
- modify global system settings
- prevent phone from sleeping
- view network state
- view Wi-Fi state
- automatically start at boot

Nowhere do I see "system log access" or anything similar.

Re:As I said last time

[amRadioHed]

No, I mean the change wouldn't have to affect anything. Apps that don't currently break during regular usage would not break with this change, because any blocked permissions could be implemented to look like situations the app already has to deal with.

Re:As I said last time

[Coren22]

http://blog.pandora.com/faq/contents/1643.html

I guess they lie in their FAQ, but they do explain why they need that access.

Re:As I said last time

[Anonymous Coward]

All that setting would do for the app maker is generate an angry call/comment from some idiot end user who didn't click on that permission... I agree it would be a cool tool for power users though.

You didn't think the idea all the way through. The fine-grained security model works, and developers should take the time to explain what's up.

When the app is installed, allow users to pick and choose the privs they want to grant (BlackBerry security model works like this when apps install). Immediately after the user sets privs, alert the user that "You have disallowed X priviledge which means Y feature will not work."

After the user has been made aware of the reduced functionality, you can disable certain features as necessary. If the app can't make phone calls, disable the call-this-business button. If the app can't access the address book, don't allow contact-lookups.

If your app breaks because of a privilege problem, and users are calling you because they don't understand, you have written a shitty app.

Re:As I said last time

[bingoUV]

Yeah, and they call you Creepy!

Re:As I said last time

[Anonymous Coward]

The app is told you only have one contact, whose name is "access denied".

Then, if the app is badly written and doesn't check, it'll just get useless data; if it's smarter, it can check the data it gets, test to see if it's the well-known dummy values, and if so prompt the user for access or something. It would be better than this all-or-nothing approach, at least.

Why wouldn't you just return empty data to the app vs. dummy values? It's a check either way.

Re:As I said last time

[Anonymous Coward]

Don't be so sure
http://www.imdb.com/title/tt1743720/

Re:As I said last time

[Anonymous Coward]

Because iOS prompts you when the app tries to access that location data, and you can deny it on a per-app basis.

Re:As I said last time

[MrHanky]

Wrong. iOS prompts you when the phone tries to use the GPS, which is unnecessary and not generally used for location data. For advertising purposes, coarse location data based on wifi and/or mobile hotspots are used.

Re:As I said last time

[cffrost]

All that setting would do for the [application] maker is generate an angry call/comment from some idiot end user who didn't click on that permission... I agree it would be a cool tool for power users though.

This "cool tool for power users" is basic functionality on BlackBerry's telephones.

Re:As I said last time

[PipsqueakOnAP133]

Wrong, iOS prompts you when the phone tries to get your location data; regardless of how. (As in, not just GPS, but wifi trilateration as well)

Shut up and take my infos!

[dleemaas]

Pandora can have the SSNs of everyone I know if they'll just keep providing their free musical goodness.

Wait a minute...

[Nidi62]

So, you mean all those ads at the bottom of the Pandora app that were specific to my home town wasn't just a random coincidence? How is it taking these things "silently" when it tells you exactly what you are giving it access too? Obviously, knowing where you live has no bearing on the type of music it's going to play. What else did people think this was going to be used for?

Re:Wait a minute...

[Anonymous Coward]

Silent == Did not read. Welcome to the Internet. Don't mind the kids; they're all addicted.

Re:Wait a minute...

[Anonymous Coward]

hear here!

Re:Wait a minute...

[p0p0]

Any app that uses internet could find out where you are by your ip address. I think the bigger issue is that when installing an app and the user is told what permissions the app is asking for, they probably don't know what half those permissions could correspond too. It's very much like an EULA. They need to be more detailed, explicitly saying that they are using the permissions to access certain files, the fies should then be listed, and clicking on them gives them a description of that file. When a user sees that an app is asking for all the things this Pandora app was looking for, a think a lot of people will decide against installing it. Also, you should be able to decide which permissions it gets. The ones you deny should just get blank data sent to the app. E.g. name/age/male should something like john doe/100/male, or GPS data should always be Google's HQ.

Re:Wait a minute...

[Simulant]

So, you mean all those ads at the bottom of the Pandora app that were specific to my home town wasn't just a random coincidence? How is it taking these things "silently" when it tells you exactly what you are giving it access too? Obviously, knowing where you live has no bearing on the type of music it's going to play. What else did people think this was going to be used for?

Until I changed my zip code on my Pandora account the day, I was getting Silicon Valley ads despite having moved to the east coast two years ago. So... actual phone location IS NOT being used for the ads, on my phone at least. Which begs the question... What are they using it for?

Just waiting for

[Anonymous Coward]

Serial rapist/killer used silent Android monitoring system to track and catch victims in locations when they where alone, outdoors and had nowhere to go.

Re:Just waiting for

[delinear]

Because that's much more plausable than just following someone, or waiting in a secldued area for someone to wander by.

what do you expect for free?

[alen]

seriously, what do you expect from a free app that streams licensed music that they had to pay for? a bunch of ads no one clicks on?

this is how google makes money, metrics. everyone is doing it as well.

Re:what do you expect for free?

[Anonymous Coward]

In other news, it's only bad (or "evil") when Google does it.

Re:what do you expect for free?

[Machtyn]

Even though those ads might be targeted towards my general location, it is still a bunch of ads I don't click on. Seriously, the phone turns off its display, I listen to the music, I don't watch the phone. I don't even mind the advertising that comes on between music, because it's not that often and I realize they have to pay for their service somehow.

It is getting a little annoying though. I thought I would be safe from those highly annoying Kia radio spots while listening to streaming music. I found out I was sadly mistaken the other day. (/me avoids ranting on Kia - never owned one, never will.)

Re:what do you expect for free?

[Snaller]

That there are a lot of amoral criminals doesn't mean it isn't wrong.

Re:what do you expect for free?

[BradleyUffner]

seriously, what do you expect from a free app that streams licensed music that they had to pay for? a bunch of ads no one clicks on?

this is how google makes money, metrics. everyone is doing it as well.

I expect it to act the same as the Free PC version on the Web. Advertising is fine. you DO NOT need access to my system logs, contact list, GPS position. Your website got along just fine without that data, so can your android app. I also expect that since I paid for a Pandora subscription on the PC that I should have access to an android version without advertising.

Re:what do you expect for free?

[Stan92057]

I expect everything to be upfront and not burried in the EULA. Why hide the fact its gathering personal data unless you know people wont use it because it does?

Re:what do you expect for free?

[bonch]

This is Slashdot. When Google indexes all your personal data for advertisers, it's okay. When non-Google companies do it, it's evil.

Re:what do you expect for free?

[rjstanford]

Or you can pay ~$3 per month and get no ads whatsoever, and much higher bitrates available to you. Its not a bad deal, actually.

What about iOS version?

[chiph]

Wondering if I should uninstall their app from my iPhone.

Re:What about iOS version?

[Anonymous Coward]

You should also uninstall the internet, because almost all ads use targeting. This story is pointless.

Re:What about iOS version?

[houstonbofh]

You should also uninstall the internet, because almost all ads use targeting. This story is pointless.

Yes, but Google does not know my gender, or everyplace I go all day. Smart phones are nice, but things like this could actually kill the market. For the most part, they are still an emotional impulse buy. If that emotion becomes fear and disgust for too many people...

Re:What about iOS version?

[DanTheManMS]

The iOS version of Pandora uses an ad framework called "Medialets" or at least it did as of an update in January 2010. Medialets is known to track exactly this kind of data (phone ID, physical location, etc). When I made a comment on their blog at the time, their response was essentially "Everyone else is doing it so it's okay."

Personally I'm jailbroken and installed the PrivaCy addon, so I *think* I'm being at least somewhat less tracked. Who knows for sure, though?

Re:What about iOS version?

[Anonymous Coward]

PrivaCy, huh? Sounds like something I should have been using already.

And doesn't Pandora ask for permission with a little notification anyway? One that actually tells you exactly what it wants? All the other apps I've ever used that wanted private data from my iPhone did.

Re:What about iOS version?

[BronsCon]

Yes, but Google does not know my gender, or everyplace I go all day.

Like hell.

Re:What about iOS version?

[Miamicanes]

Dude, I hate to break it to you, but Google knows more about you, what you like, buy, are interested in, and do, than you do. It's a damn good thing they try to not be evil (even if in reality, the occasionally end up being like the US in Team America: World Police), because they'd have the Devil himself running scared if they were ever bought out by a Wall Street hedge fund, or went bankrupt and had their data purchased by companies like Experian.

Re:What about iOS version?

[BronsCon]

You're not breaking anything to me. I summed up everything you just said in 2 words in the post to which you just replied.

Re:What about iOS version?

[tgd]

You should also uninstall the internet, because almost all ads use targeting. This story is pointless.

Yes, but Google does not know my gender, or everyplace I go all day. Smart phones are nice, but things like this could actually kill the market. For the most part, they are still an emotional impulse buy. If that emotion becomes fear and disgust for too many people...

And yet most ad networks do.

He's listening to Steve Miller

[chemicaldave]

Now he's listening to Nirvana...now he's listenning to David Bowie...now he's listening to Twisted Sist- oh wait he skipped that one.

Re:He's listening to Steve Miller

[tophermeyer]

I think I finally beat the Pandora algorithms when I started getting Elton John and Kid Rock on the same station.

Live in Application

[ObsessiveMathsFreak]

The big problem here is that whenever you install any application, you're technically giving the designers virtually free reign to do whatever they like with your system/PC/phone/whatever.

Once permitted in, most commercial applications barge into your PC, rewrite whatever files they please, alter configuration settings, gobble up memory, install themselves as startup applications and often install an entire suite of unwanted applications and advertisements you didn't even ask for. Then they plonk themselves down in your living room, feet on the sofa, and begin to shout at you, along with all the dozens of other loudmouth applications you've invited in.

Re:Live in Application

[Haedrian]

Android has a list of 'permissions' which you must give an application access to before it can use them. Unfortuantly its an 'all or nothing', sort of thing, so you either accept them all and install it, or deny them all and don't install it.

It does not give the designers 'free reign' to whatever they want. So if you accepted that an app gets access to logs, to your location, to your phone ID, then its your fault and you only have yourself to blame. Granted, its a legit app, if it was a virus that's different.

Re:Live in Application

[houstonbofh]

And people ask why I still have a dumb phone...

Re:Live in Application

[Anonymous Coward]

Google's business model leads to making computing as annoying as television.

Re:Live in Application

[Anonymous Coward]

Because you're dumb?

Re:Live in Application

[tukang]

Exactly, security is one of the key reasons why web applications have become so popular on the desktop and I think we'll see a similar movement away from live in apps to web apps on smartphones. I never understood why people would install a live in app for Amazon or the NYTimes on their phone when they could just visit the website versions (which work much better by the way). Imagine installing binaries on your desktop for every e-commerce or news site you used - you're bound to get screwed.

Re:Live in Application

[Sloppy]

It sounds like what Android needs, is an Android emulator. Let apps access everything they want to, but how reliable is the information that it'll get them?

If Pandora really wants to know that I happen to spend 183 days a year at the south pole and then sudden travel north at 18000MPH on the first day of autumn, and that my best friend's email address is abuse@spamhouse.org, I say let them know these things.

Re:Live in Application

[npsimons]

Once permitted in, most commercial applications barge into your PC, rewrite whatever files they please, alter configuration settings, gobble up memory, install themselves as startup applications and often install an entire suite of unwanted applications and advertisements you didn't even ask for. Then they plonk themselves down in your living room, feet on the sofa, and begin to shout at you, along with all the dozens of other loudmouth applications you've invited in.

Two things:

1. This is *precisely* why open source is needed, and yes, you can make money selling open source software. Then if your customers decide they don't like the way your app works, they can cut out the shit part and fork it. Just more motivation not to do any of the above.
2. People might question the wisdom of ubiquitous VMs (say, even on smartphones), but even just chrooting or jailing apps could help curtail some of these problems. I was incredulous when I saw an article about VMs on smartphones, but it makes sense in this context.

Of course, the real question is, why trust an entity (the people making the software) who obviously wants to do you harm? Stop using software and products designed to work against your own best interests!

Re:Live in Application

[Anonymous Coward]

A typical Slashdot response.

You know what? I don't use software X/hardware Y, and don't know anything about either. I should go write a bunch of ignorant comments on all the articles about them!

Re:Live in Application

[houstonbofh]

I actually know quite a lot about them. I support all of them every day. That is why I do not want one. A more expensive plan with a privacy raping and security nightmare, on a platform that will be unsupported in 2 years, all so I can shake my hand to find a new restaurant?

Re:Live in Application

[Anonymous Coward]

Remember back in the late '90s and early '00s when everyone out there offered a "free" Internet Explorer toolbar?

Just replace Internet Explorer with iPhone/Android and toolbar with app and you have the same idea.

Without Android Permission?

[Anonymous Coward]

Does anyone know how they collect geographic information when the application requires neither coarse location nor fine location?

The lack of those Android permissions either makes this a bigger story than simply Pandora sending information, or it makes me skeptical of the researchers' claims.

Re:Without Android Permission?

[WhirlwindMonk]

I imagine it determines your location when over wifi and assumes that's where you are until it detects a new wifi connection. I'm guessing this since while on the road in Ohio and Pennsylvania, it gave me ads relating to stuff in southeastern Michigan, the last area I'd connected to wifi in.

Re:Without Android Permission?

[xaxa]

Does anyone know how they collect geographic information when the application requires neither coarse location nor fine location?

The lack of those Android permissions either makes this a bigger story than simply Pandora sending information, or it makes me skeptical of the researchers' claims.

Maybe (and this is only a guess) they turn on WiFi and look at nearby SSIDs, the same way Google does.

The app has permission to alter network state and look at WiFi settings: https://market.android.com/details?id=com.pandora.android

Re:Without Android Permission?

[Stenchwarrior]

I would imagine all the app needs to do is see what IP you're connected to the internet from, whether you're on WiFi or on the mobile network. Just about all subnets are traceable to a city.

Re:Without Android Permission?

[Pollardito]

I've seen more and more apps adding "Change Wi-Fi State" permissions, and i wondered why that was. I assume they do it because otherwise you can install the app, but then turn off GPS and/or coarse GPS system-wide and they get nothing. This way they can get it regardless.

I actually uninstalled Pandora when I saw that it had access to my contacts and calendar. I think that would have stuck out to me when I installed it, but I think it came pre-installed on my phone. A month later they updated it, and I saw that crazy list of permissions and uninstalled it

Re:Without Android Permission?

[makomk]

Having read their actual analysis which was linked by someone in a comment further down, it would appear they're not actually reading the code correctly. They claim that calling unknown.checkCallingOrSelfPermission "requests permissions for both COARSE_LOCATION, and FINE_LOCATION". What it actually does is check whether the app has these permissions, presumably so that the library can skip any attempt to retrieve GPS information when used in an app that hasn't requested permission to do so.

Re:Without Android Permission?

[rjstanford]

Or in this particular case, maybe they want to do that so that they can send you music over wireless when available, at higher fidelity with lower battery drain?

SELinux type security for Android

[Bocaj]

Google needs to change the security model to allow finer grained access and more information to users about how much information that access allows. I should be able to install an application that wants access to my contacts but choose to deny that access with a warning that it may affect the functionality of the app. There should be more detail information on just what information an application can get hold of with that access. I think using the SELinux model of security in the kernel would be a good idea. If I don't grant an application process rights to certain files, it can't get access no matter what.

Re:SELinux type security for Android

[L4t3r4lu5]

This is too complex. Here is an alternative solution:Don't install apps which require permissions you don't agree with.

If I see an app which is nothing to do with my phone book, or messaging, or system settings, and it requests those permissions, the app is not installed.

Re:SELinux type security for Android

[Digicrat]

That was my thought the first time I downloaded an app from the android marketplace to. It lists all of the permissions an application is requesting, but your only option is allow-all or don't install. I should be able to install a given app but tell it, no I don't want it to use the internet (if it's ad-supported, the app can then choose not to work), or deny the ability for an app to get anything but the coarsest location data (a weather applet doesn't need to know that I'm at the intersection of Fake St. and 5th when its database is based on city/town).

In many cases you can find alternatives, but they often don't work as well. Some applications provide preferences to toggle what data they actually look at, but others either don't, or would be safer if one could verify that it can't.

Re:SELinux type security for Android

[standbypowerguy]

SELinnux? You're kidding, right? I'm a longtime Fedora user, and it's shipped with SELinux since FC2, I think. Although the policies and tools have improved drastically, some things like Apache, Samba and 3rd party RPMs still require manual intervention, sometimes to the point that it's simply easier to simply disable. It's hardly ready for Joe Sixpack's Adroid phone.

Re:SELinux type security for Android

[Anonymous Coward]

Your approach requires that people think. People are mostly incapable of even the simplest degree of thought when it comes to such things. I don't know why - they just can't do it.

Re:SELinux type security for Android

[Pollardito]

They seem to all add this stuff in lockstep though, so there doesn't seem to be a way to vote with your feet on some things short of the nuclear option. If the advertising networks demand it, you're not really going to get some app deciding to buck the trend to get more downloads if it means they lose all their ads. There are so many monopolies, duopolies, and cartels (RIAA/MPAA) upstream of the consumer these days that competitive pressures aren't doing what they should.

Re:SELinux type security for Android

[Sloppy]

The way to win is to give them all the permissions that they demand, but have the things they access which you don't want them to, be unreal. Don't say no to them; jam them.

Re:SELinux type security for Android

[L4t3r4lu5]

There's a reason for me not having Angry Birds on my Android phone. Not the same reason being discussed here, but it does involve advertising. I did enjoy the game, but I can do without very easily.

It's down to the user taking a stand, but they're all too self absorbed in eating that damn marsh mallow that the rest of us get it shoved down our necks, and no option to wait for two later on.

Re:SELinux type security for Android

[Snaller]

Yes, THIS is a real problem with android, not all that faux "fragmentation" rubbish the supposed journalists go on about.

Re:SELinux type security for Android

[Lehk228]

Blackberry OS already does this with an option for approve/deny/prompt so you can allow, for example, gps when you want location based functions but not give the app the ability to track you at all times

Re:SELinux type security for Android

[Pollardito]

I would consider "I won't use an app with ads" an unreasonable requirement, but it's obviously something that you're passionate about so I'll say to each his own. The problem is that if 99% of the market doesn't feel the same way that you do, then it's likely that you might not be able to find a single app in a category that fits your needs. Angry Birds has about a billion competitors though, so I think that's something different than what I'm talking about.

My problem is when I see apps like this or this that are obviously over-reaching. I don't think that it's just the case that most people don't look at the permissions of apps they're installing, though I do think that is part of the problem. I think that permissions of apps that the maker knows will come pre-installed on phones quite often have these crazy permissions (since the user didn't do the first install they didn't read it), and I think that there are also categories of apps where there are few competitors where they've essentially all agreed to ask for too much because like I said the "nuclear option" of not installing any app from an entire category is rarely taken.

Re:SELinux type security for Android

[rjstanford]

Your approach requires that people think. People are mostly incapable of even the simplest degree of thought when it comes to such things. I don't know why - they just can't do it.

And those people would be able to figure out SELinux permissions, where 9/10 sysadmins give up at some point?

Re:SELinux type security for Android

[Man Eating Duck]

My problem is when I see apps like this [android.com] or this [android.com] that are obviously over-reaching.

I would be very surprised if the ZXing Barcode Scanner did anything underhanded, it's open source after all. They also explain why they prefer those permissions.

On a side note I'd love to be able to specify allow/ask/deny permissions for every feature the program wants to access, for instance I've metered internet access, and do not want apps to be able to use it freely.

Not just android

[ender-]

The actual Vericode post says it's both the iPhone and Android versions. I'm not sure why the article linked in the summary [and thus the summary] only mentions the Android version.

I wonder then, does the web browser interface do something similar, minus the GPS info of course? What about the Pandora One desktop app?

Re:Not just android

[LoganDzwon]

I was about to reply that I found it "very suspicious that the article omits ios... " then I reliezed your article doesn't either. It just includes a quote from another article; http://online.wsj.com/article/SB10001424052748703806304576242923804770968.html which explains why there were looking, not what they looked at. The iOS version simply was not examined for this test. Most likly because an iOS app is not privileged to the pivata data in question. That whole walled garden thing.

Re:Not just android

[Anonymous Coward]

Actually the Vericode post just examined the Android version. They quote the Wall Street Journal Article that says it is for both the Android and iPhone versions: http://online.wsj.com/article/SB10001424052748703806304576242923804770968.html

Re:Not just android

[rocketPack]

Was someone under the impression that any of this was a secret?

One need only look at the privacy policy to figure this out: http://www.pandora.com/privacy/

Information about your computer or device: We may also collect information about the computer, mobile or other devices you use to access and listen to the Service. For example, our servers receive and record information about your computer and browser, including potentially your IP address, browser type, and other software or hardware information. If you access the Service from a mobile or other device, we may collect a unique device identifier assigned to that device or other transactional information for that device.

With such headings as "Automatic Data Collection", "How we use the information we collect:", and "How the information we collect is shared:" it's kind of hard for me to see how there was any ambiguity?

On the other hand, I know most people never bothered to read the privacy statement but that is by no means Pandora's fault. They provided the information - if users failed to actually read it, that's on them.

Re:Not just android

[Anonymous Coward]

It isn't privileged to some of the data, but the rest just flies underneath your nose without you knowing.

What's needed

[Anonymous Coward]

Is an app that sits between your personal and phone info and all your other apps and controls what data gets presented to each app

Re:What's needed

[macs4all]

Is an app that sits between your personal and phone info and all your other apps and controls what data gets presented to each app

You mean, something that keeps each app in something akin to its own "play area". Kind of like a kid's sandbox...

Now only if there was a mobile OS that did that for you. And even better, one that automatically asked you for permission when certain "privacy-related" features, like location services, are accessed by an app for the first time, and gave you an easy-to use way to see if an app had tried to do that in the past 24 hours, and even better, let you change your mind about permissions after you had already installed the app, on a global, or app-by-app basis.

Oh, wait...

Everybody's doing it

[countertrolling]

Pandora got caught. Getting caught is the anomaly. And people will never learn that there is no privacy on a networked computer

Re:Everybody's doing it

[sandytaru]

Just because everyone is doing it doesn't make it right - or legal.

Re:Everybody's doing it

[clang_jangle]

...people will never learn that there is no privacy on a networked computer running proprietary software or on proprietary networks.

FTFY. Those of us who use FOSS are the only people who have a shot at actual privacy. Note, I say "we have a shot". You can still make thousands of tiny mistakes that will screw it up. The cell providers are another story, there's no privacy for anyone on the proprietary networks available.

Re:Everybody's doing it

[houstonbofh]

...people will never learn that there is no privacy on a networked computer running proprietary software or on proprietary networks.

FTFY. Those of us who use FOSS are the only people who have a shot at actual privacy. Note, I say "we have a shot". You can still make thousands of tiny mistakes that will screw it up. The cell providers are another story, there's no privacy for anyone on the proprietary networks available.

I was gonna say... There is privacy on mine. But it takes a lot of work.

Re:Everybody's doing it

[circletimessquare]

there's no privacy with an open window either. that still doesn't mean i'm not going after the guy standing outside writing things down in a notebook. just because you can't lock things down technologically doesn't mean you have no basis for going after bad behavior. bad behavior is bad behavior is bad behavior. "because i can" is not a justification or excuse in any morality i know of, nor is it a reason to tell someone who has been violated that it is their fault

if i put a $20 bill on my front porch, yes, i'm stupid, and yes, i'm going to lose $20. but the guy who trespasses onto MY porch and takes $20 which is clearly not his and clearly not offered to him is still a thief who should be prosecuted for theft, to exactly the same degree as if he reached into my pocket or reached into my upstairs safe or hacked my bank account. same crime. do you understand why its the same crime? the idiocy of computer users does not excuse the evil of transgression

what bothers me is not specifically your post, but the kind of logic i see in your post, all the time, not even just in terms of computer security: "you didn't protect yourself, so you deserve what happened to you." this is the same failed way of thinking about right and wrong as "did you see the dress she wore? she was asking to get raped."

you, and many others, fail at basic morality. i don't know exactly what the problem is, but i would guess it is simply that you indeed are looking to excuse your bad behavior in one way or another: "they were weak, so they deserved it" is a pretty common failed way of thinking about the world. i see a criminal conviction some time in your future if you don't wake up and understand that the person who does something wrong, is wrong, period, no matter how stupid, drunk, gullible, clueless the victim

Re:Everybody's doing it

[Anonymous Coward]

Pandora didn't get "caught" at all; their privacy policy makes it clear what they do, and the apps ask for access. Further, the app doesn't "collect" personal data from the phone; contacts, calendar and other access is used to support user-initiated features, like emailing a station, or inserting an event in the calendar (again, only ever done at the user's request.)

The only "personal" data sent to advertisers comes from the Pandora registration process *not* from the phone:
"Pandora gathers the age and gender information when a user registers for the service." (Which you may not like, but it's in their privacy policy.)

The only data gleaned from the phone that Pandora might be sending to advertisers is location. So *maybe* they know where a certain phone has been - which is information already in the service provider's database.

Re:Everybody's doing it

[countertrolling]

My point is, don't single out Pandora. The problem is global throughout the industry.. Attack it from that angle instead of playing whack-a-mole

Re:Everybody's doing it

[M. Baranczak]

No, we should do both. Whack Pandora to make an example of them, then find all the other marketing shitbags who are doing this and whack them too.

Re:Everybody's doing it

[Anonymous Coward]

I'm looking to direct a low-budget Filipino Horror Movie in NYC. Contact me at: i@eatdelicioussoup.com .

Re:Everybody's doing it

[countertrolling]

'Morality'... That's funny.

And by the way, if you leave your window open, whatever a person is doing from outside your property is not for you to interfere. The theft of your $20 involves real physical trespassing. Looking in your window is not. Try again... or lose your turn, and this time, try to comprehend the original post.

You get what you pay for

[bitroli]

When you install that application on android (or any application for that matter), you have to grant it (and by that I mean, acknowledge) permissions asked by the application.

It's the lusers fault for giving "Tom Talking Cat" privileges to fully control their phone, GPS, read contacts, browse the internet freely.

No idea if that app actually asks for all that crap, but there are plenty that do when they're nothing more than a stupid text editor.

Re:You get what you pay for

[chemicaldave]

Those permissions requests are worthless. They only tell you what the phone needs access to, not why. I'm sure there are legitimate reasons for some of them, but who knows? There's no accountability.

Re:You get what you pay for

[mastershake82]

Well, if you are installing an Angry Birds clone, and it tells you it needs access to your dialer to make phone calls and your messaging to send text messages then maybe... just maybe... you shouldn't install it.

The Android notification of what parts of your phone the app will use are perfect. It allows an app to request whatever it needs on a very low level, and for you to know that it is requesting it. There is DEFINITELY a gray area when you are installing something that will actually use a sensitive part of your phone such as the dialer / GPS / messaging... but at some point, you have to do your research and make sure you trust the developer and that the software is actually from the developer on the app store, not somebody who modified their app and re-uploaded it.

You say it doesn't tell you why it needs it... but you should know why from the type of application it is. And if the why of the application type doesn't match the data and access requested, don't install it. I'm sure Android could add a 'why' area for each permission for the dev to put in a reason, which actually might be nice, but it won't be any more secure, as the people who are releasing malicious apps are the same social engineers who have perfected duplicating emails from your bank almost perfectly.

The only more secure way they could do it would be, "We see you've selected Angry Birds, please review the entirety of the source code presented below and all of it's resources to ensure that it won't do anything malicious to your phone."

Re:You get what you pay for

[chemicaldave]

You say it doesn't tell you why it needs it... but you should know why from the type of application it is. And if the why of the application type doesn't match the data and access requested, don't install it. I'm sure Android could add a 'why' area for each permission for the dev to put in a reason, which actually might be nice, but it won't be any more secure, as the people who are releasing malicious apps are the same social engineers who have perfected duplicating emails from your bank almost perfectly.

We're not talking about malicious apps. This is Pandora. And you're right, once you start installing apps off the market you're on your own. But 95% of users aren't doing that. They expect transparency in the applications from the market. Right now as I attempt to install Pandora it makes no mention of access to the personal information mentioned in TFA. One thing it requests is access to "Phone calls: read phone state and identity." What does that mean? Does it mean I can accept a phone call from the app gracefully? Does it mean Pandora can collect that information and keep track of who is calling me? The request is ambiguous. Same thing for "Your personal information: add or modify calendar events and send email to guests, read contact data." Again, ambiguous. Maybe it uses the contact data to show who is calling if you receive a call during playback?

The only more secure way they could do it would be, "We see you've selected Angry Birds, please review the entirety of the source code presented below and all of it's resources to ensure that it won't do anything malicious to your phone."

How about making the developers take some responsibility and say what they're doing instead of releasing them of all responsibility and making the user go through source. Even if that was the only way, what's to stop the developers from obfuscating the code?

The "it's free so shut up" mentality has to stop. If your product/service really is so good then let the users decide if they want to release their information or buy a subscription. Going behind the users' backs is deceptive, and an insult to the intelligence of their customers.

Looking forward for Pandora IPO

[ub3r n3u7r4l1st]

Despite the suit, recent SEC filing suggest eveything pointing up:

        * Revenue skyrocketed from $55,189,000 in FY2010 to $137,764,000 in FY2011.
        * Advertising revenue rose from $50,147,000 in FY2010 to $119,333,000 in FY2011.
        * Subscription and "other" revenue increased from $5,042,000 in FY2010 to $18,431,000 in FY2011.
        * Despite rising content acquisition costs (up from $32,946,000 to $69,357,000 between FY2010 and 2011), Pandora's loss narrowed from $15,549,000 in FY2010 to $321,000 in FY2011.

Despite strong competition such as Sirius XM radio and even Apple to that regard, I wouldn't worry much.

Re:Looking forward for Pandora IPO

[david_thornley]

The other interesting thing about those figures is that it shows how much advertising revenue is compared to subscription and "other". It does rather show who Pandora is likely to favor in an argument.

Re:Looking forward for Pandora IPO

[tgd]

And strangely, even when I wasn't paying for it, I virtually never heard an ad.

I suspect they're lumping the kick-backs from music stores when they link users over to them under "advertising". I've bought lots of music through referral links on Pandora, but really never heard ads.

Pandora's Box

[Anonymous Coward]

Doesn't the name imply that there is trouble inside? Where is the false information in that. I guess you could say Veracode opened Pandora's box.

Obvious what they are doing

[Hoi Polloi]

Gender, location, phone? It is clear what the people at Pandora are doing, trying to get dates.

Re:Obvious what they are doing

[berashith]

yup , the stalkers employed by pandora can send Barry White tunes to any stranger that they need to get in the mood.

Foul playback

[DigiShaman]

Honestly, I wouldn't mind them doing this if they had been clear and upfront with their intentions. Something along the lines of...

"We will provide you a free service in exchange for client usage statistics. This information will be shared with 3rd party marketing firms"

It's not so much what they do with this information in so much that I no longer feel safe reading this first time on Slashdot. How can I trust them now? I can never trust a sneaky bastard. Because of their lack of disclosure, Pandora just got uninstalled from my Droid.

Re:Foul playback

[RobotRunAmok]

"DigiShaman," eh? Maybe you need to upgrade your runes...

OBVIOUSLY Pandora is collecting information about you and selling it to advertisers. They provide a free internet service, and have insanely high licensing costs; how did you think they were being funded, the Committee for Public Broadcasting?

Now, check your digi-Ouija board and tell us why Google provides people with free e-mail service and gigs upon gigs of free storage...

Re:Foul playback

[andrewd18]

If you're willing to assume that all companies are going to keep your data safe, you're awfully naive. Whether or not they should is one thing... whether or not they will is another.

Besides, it's not like you couldn't have seen this coming. When you install the app to your Android phone, you get the following screen:

This application has access to the following:
* Network communication (create Bluetooth connections, full Internet access, view network state, view Wi-Fi state)
* Your personal information (add or modify calendar events and send email to guests, read contact data)
* Phone calls (read phone state and identity)
* System tools (Bluetooth administration, change network connectivity, change Wi-Fi state, modify global system settings, prevent phone from sleeping, automatically start at boot)

If that doesn't scream "We are going to take data about you and sell it", I don't know what does.

Re:Foul playback

[Anonymous Coward]

It's simple: if you are not paying for a product, YOU are the product. You should uninstall the internet.

Re:Foul playback

[Anonymous Coward]

Honestly, I wouldn't mind them doing this if they had been clear and upfront with their intentions. Something along the lines of...

"We will provide you a free service in exchange for client usage statistics. This information will be shared with 3rd party marketing firms"

It's not so much what they do with this information in so much that I no longer feel safe reading this first time on Slashdot. How can I trust them now? I can never trust a sneaky bastard. Because of their lack of disclosure, Pandora just got uninstalled from my Droid.

It seems pretty clear and straightforward to me; not that I read this before I clicked through the agreements, but still, it's out there for consideration if you're really of the opinion that anyone providing an ad supported service isn't in bed with the advertisers. I don't see this as sneaky, I see it as leveraging the most viable business model for a service that has to work with content licensers.

http://www.pandora.com/privacy

Re:Foul playback

[O('_')O_Bush]

If it bothers you that much, fork out the 36$/year for Pandora One and avoid advertising altogether. I mean, 36$/year is pretty cheap for unlimited music streaming to our phone in comparison to buying the songs individually.

It's not like Pandora forced you into taking their free, ad-based service, since they offer a paid, ad-free version. Targeted ads are the new definition of ad-based nowadays anyways. Just look at Facebook.

Re:Foul playback

[DigiShaman]

I get the gist of how Google runs their business. But I wasn't really sure about Pandora. Ya, I suspected they sold playback statistics to 3rd party firms. But I did not suspect to what depths they went, or even if this was their actual business plan. For all I knew, Pandora was acting as a loss-leader. That is, they would pay for the cost up-front to get large user install base, then capitalize on it later through a premium subscription plan.

Re:Foul playback

[DanTheManMS]

If it bothers you that much, fork out the 36$/year for Pandora One and avoid advertising altogether. It has nothing to do with the ads being played on the stream itself. Nobody's complaining about those. It's about Pandora collecting and selling your private information to other 3rd parties without clearly stating as such.

Unless you're suggesting that by forking over $36 a year, they WON'T actively track your data, which we can reasonably assume is false. Sure you don't get ads, but they're still violating your privacy.

Re:Foul playback

[DigiShaman]

And I should trust them now? How do I know they're not double dipping into my wallet AND selling my usage stats to a 3rd party?

Trust. A concept that's very hard to earn, and easy to lose. They've lost mine.

Re:Foul playback

[O('_')O_Bush]

"We use the information that we collect and you provide about yourself to personalize your PANDORA® internet radio experience through ads and social networking features."

Right there in the Privacy Policy that you didn't read. http://www.pandora.com/privacy

They never lied to your or tried to hide anything. They tell you they collect information from you to customize ads and give that information to a third party. What more do you want to know?

Re:Foul playback

[L4t3r4lu5]

If they still do that if you pay for the service, and don't get the ads.

Re:Foul playback

[chemicaldave]

Just because the app is free doesn't mean they need to use deceptive practices to pay for it. It's going behind the users' backs and insults their intelligence. If the app really is so great then tell the customers and they'll buy a subscription. If you have to lie to your customers to provide the service then you shouldn't be offering it to begin with.

Re:Foul playback

[rocketPack]

Really? this wasn't clear and upfront enough?

Re:Foul playback

[Anonymous Coward]

When you install Pandora One, what access does it ask for?

Geolocation APIs (and opinion)

[Jahava]

The actual Vericode post says it's both the iPhone and Android versions. I'm not sure why the article linked in the summary [and thus the summary] only mentions the Android version.

I wonder then, does the web browser interface do something similar, minus the GPS info of course? What about the Pandora One desktop app?

There are specs for getting geolocation information via JavaScript, so possibly. However, your browseri s supposed to ask your permission prior. This also doesn't preclude other Pandora components, such as Flash, which may have their own API.

That said, am I the only one who just doesn't care? This company is providing bandwidth and fronting music industry negotiations in order to deliver a useful and valuable service to me for free. As per the implicit (and explicit) contract with almost every modern free service, it's a willing exchange of information, and I'm perfectly willing to trade my phone ID and location for this service (for now).

It would be nice, though, if there was an Android requirement that each application disclosed exactly what data it was collecting, and for what purpose, in order to be included in the Marketplace.

Re:Geolocation APIs (and opinion)

[k_187]

That said, am I the only one who just doesn't care? This company is providing bandwidth and fronting music industry negotiations in order to deliver a useful and valuable service to me for free. As per the implicit (and explicit) contract with almost every modern free service, it's a willing exchange of information, and I'm perfectly willing to trade my phone ID and location for this service (for now).

It would be nice, though, if there was an Android requirement that each application disclosed exactly what data it was collecting, and for what purpose, in order to be included in the Marketplace.

Personally, I don't think its the end of the world. its a free app and you should expect to be giving away at least some of your information in exchange. However, they should be up front about what they're taking, which if I've read the article correctly, they aren't.

Pandora? pfft

[Anonymous Coward]

Use Slacker. It's just better.

Re:Pandora? pfft

[nschubach]

Slacker Radio

System Tools
Change Network connectivity, change Wi-Fi state, read system log files, prevent phone from sleeping.

Network communications
Full Internet Access

Phone calls
Read phone state and identity

Storage
Modify/delete SD card contents

Why does a radio app need to be able to turn on/off my wifi? Why does it need to read my system logs? Why does it need to be able to add or delete things from my SD card? (It's streaming music...)

Re:Pandora? pfft

[berashith]

which has this permissions screen ....
System Tools
Change network connectivity, change Wi-Fi state , read system log files, prevent phone from sleeping
Network Communication
Full Internet access
Phone Calls
Read phone state and identity
Storage
Modify/delete SD card contents

So, not a whole lot of difference. The arguments on which radio app to use needs to be on the merits of the app/song selection, not on the treatment of your privacy.

Re:Pandora? pfft

[bhcompy]

Slacker doesn't just stream, it stores data. You can sync your Slacker to save hours of steams to your device for later playing. This is also why it can change your wifi state. Granted, the Slacker Player itself is the best way to go

Re:Pandora? pfft

[nschubach]

Okay, I'll accept the SD storage requirement (wish I had the ability to say, "Here is where you will store your data and this is the only folder you will see" though)... but system logs? The WiFi state change I do not understand. If I wanted it to connect to a WiFi node, I'll turn it on. It should use whatever connection it's told.

This is unacceptable!

[fuzzyfuzzyfungus]

Only the mobile phone carriers should be allowed to collect large, but unknown, piles of personal information silently and without oversight! It is an outrage that others would dare to step onto the rightful domain of these oh-so-helpful surveillance buddies.

On a more serious note: What I would really like to see in Android(and other mobile operating systems; but a 3rd party build of Android is pretty much the only one where this would ever see the light of day on any hardware that isn't a laptop-size dev board...) is a supplement to the existing system of granular access-request application permissions:

Spoofing.

At present, you can see what permissions an application demands(perhaps not at quite the level of granularity that would be ideal; but the concept is good, and refinements aren't fundamentally challenging); but you have no way of pushing back against an application that seems a bit uppity, other than refusing it. What would be ideal would be a way of setting up multiple instances of the various Android content providers. One set of instances would be the 'real' one, populated with actual system data(address book, location, etc, etc.) Other instances would be various flavors of 'fake', either generated by applying an overlay filter to the real ones(ie. I might want to give an application that uses location data access to 'location data, but truncated to ~city level accuracy', which would be a content provider generated by a simple mathematical operation against the genuine content provider for location data), or auto-generated to look plausible; but be completely unrelated to the truth(ie. an 'address book' consisting of a simple dump of 47 name/number pairs from a phone book). This would allow you to push back against applications that demand more than they need to know; by allowing you to fulfil their architectural 'requirements'; but choose for yourself which are actually necessary for what you want to do(if you want a navigation app to work, you do need to give it your real location. If you just want dining recommendations, you may only feel the need to give it city-level accuracy, and feel no need whatsoever to give over your real address book for 'social dining integration'...)

Such a system would have additional benefits: it would make tasks like separating work/personal(or personal/er... 'extracurricular' if that is your style) architecturally clean and much lighter-weight than virtualization. You could have multiple true address books, say, one accurately reporting your personal contacts, and one accurately reporting your work contacts, and you could point twitfrienddroidfeed at the first and seriouscorporatemail at the second.

Re:This is unacceptable!

[Anonymous Coward]

Remember that 95% of the marketplace are fools and sheep who don't understand granular security. They just want the free music.

I can't even count how many times I've looked at systems and asked the user "Why on earth did you install this?" to which they reply "Because it said I should."

No matter how much security control you give to the populace, it takes effort to use it. Most won't. And remember, that the "Common man is a fool".

Re:This is unacceptable!

[wumpus188]

You are asking an advertising company that developed Android to provide API to subvert advertising? Good luck with that...

Re:This is unacceptable!

[fuzzyfuzzyfungus]

Just for the sake of clarity, having thought about it a bit more(post in haste, repent at leisure...), what I'm proposing would, basically, be a sort of "data chroot".

There would be the host android system, with one or more optional "data chroot" containers underneath. For the convenience of the host system, each would simply be a 'subdomain' of the primary URIs; but(as with a chroot for filesystems) programs within the chroot would see the data URIs exposed to it as originating from the root URI.

All "data chroot"s would have the full set of standard data URIs(along with any provided by applications installed within them); but those standard data URIs would be derived from the real data URIs by a set of filters specific to that "chroot". Some would be passed straight through, if the applications inside are trusted with it, some would be programmatically modified(as in the accuracy-reduction of location data) and some would ignore the root URI entirely and fabricate a fake one with no relation to the real one(as with a false set of contacts).

When an application is installed, and asks for access to a specific set of permissions, you could either grant them, or grant them within the context of a "chroot" in order to control the application's access to real data.

Conceivably, other sorts of system resources that are amenable to a 'filter' model could also be thus controlled(a given "chroot" might have an IPtables config associated with it, for example, that would impose additional restrictions on any application within the "chroot" that is given network access.)

Obviously, the configuration of such things would be pretty hairy for an average user; but it would hardly be inconcievable to have installable 'filter bundles' that could be snapped in to the system, and then used to spawn new "chroot" instances easily. As with firefox extensions or greasemonkey scripts, some would be fairly generic(say, one that simply spawns an empty set of data providers, with no other restrictions, that would allow you to easily create a 'home' and a 'work' container with distinct contacts and such), others would be fairly tightly tailored to specific use cases(an obfuscation container for some particularly grabby app, say).

Re:This is unacceptable!

[fuzzyfuzzyfungus]

"but a 3rd party build of Android is pretty much the only one where this would ever see the light of day"

I don't think for a second that our Google overlords would touch this idea with a ten foot pole(unless they adopted some variant of the data URI namespacing to add features that corporate customers wanted, to compete with the full hardware-virtualization stuff that Vmware is proposing, and only for that purpose).

Android, though, is the only current candidate where a reasonable percentage of mass-market hardware is within the realm of practical 3rd-party OS builds. A fair number of phone models are well understood enough to replace more or less everything above the bootloader, and enough of the Android sauce is OSS that modifications to it can reasonably be made. Were this to occur, it would be a 3rd party thing only, Google would have no incentive to either hamper its own advertising efforts or scare developers away.

Re:This is unacceptable!

[Anonymous Coward]

There is (an attempted) app for that: Privacy Inspector

Word is, the pay version recompiles apps to send whatever data you choose.

I make no claims to its legitimacy, but the idea has merit, as does yours.

Spoofing does seem like a lot of work though. Why is the onus on me? I like the granular permissions approach better and would be happy to "train" apps to behave like the good monkies I need them to be.

If the service is provided free

[wiredog]

the you, the user of that service, are the product.

How is this Illegal?

[softWare3ngineer]

Please excuse my ignorance. but how is this illegal? companies do this all the time over the web. tracking where you log in from, how long you are one each page, and what sites you visit every time most people use the Internet. I think this practice is defiantly immoral, but give how constrictive contracts are I don't see how this is against the law. if you could point me towards some case law or a brief it would be much appreciated.

Re:How is this Illegal?

[BradleyUffner]

Please excuse my ignorance. but how is this illegal? companies do this all the time over the web. tracking where you log in from, how long you are one each page, and what sites you visit every time most people use the Internet. I think this practice is defiantly immoral, but give how constrictive contracts are I don't see how this is against the law. if you could point me towards some case law or a brief it would be much appreciated.

That's one thing... Freely accessing your address book, including full name, phone numbers, and address of everyone it, and complete access to your system logs and dialing history is something else all together.

I don't think it's automatically criminal though... Android DOES tell you that the phone can access this data at installation time, and you can choose not to install it. Bit it is walking an awfully fine line.

Gender?

[Anonymous Coward]

Why does your phone know your gender in the first place?

Re:Gender?

[AHuxley]

All the better to target ads at you my dear!

Re:Gender?

[O('_')O_Bush]

It doesn't necessarily. Your Pandora account does though since you filled that out when making it.

No Yes

[Darth Snowshoe]

Let me just say, their Yes channel is awesomely crappy and incomplete. Did those guys never hear of RELAYER? Hello? Classic, amirite?

That's Odd

[pavon]

The only ads I ever got on Pandora before paying were those "cheap vacations for students" ads over and over and over again. Nothing localized/individualized at all.

Re:That's Odd

[Creepy]

On android I believe it asked for GPS access, which is another reason I didn't install it (and I only made it through the top maybe 10 entries of access rights it wanted before I said no-way, no-how is this going on my phone). Since mobile phones aren't tied to location like land lines, it is more reliable to use GPS location than area code. Anyhow, if you didn't have a GPS or if your GPS was turned off it may have defaulted back to generic ads.

Re:That's Odd

[tophermeyer]

Anyhow, if you didn't have a GPS or if your GPS was turned off it may have defaulted back to generic ads.

Yes.

When I have GPS off I get generic ads. When I have it on I get location specific ads. This is really amusing for me because the only time I let GPS run is when I'm driving and need Navigation, so while the ads might be localized they are most definitely not relevant.

Re:That's Odd

[Isaac Remuant]

Sure they are:

Five miles ahead, there's a McTaco Store, You KNOW you want a Taco!
*Switchs to the song: "Oh, lovely, lovely, Taco".*

Re:That's Odd

[mrchaotica]

"Oh, lovely, lovely, Taco" isn't a real song. Try Taco Grande by Weird Al instead.

Re:That's Odd

[MrHanky]

Anyhow, if you didn't have a GPS or if your GPS was turned off it may have defaulted back to generic ads.

No. The phone can get coarser location data from wireless and mobile networks. But you can turn off that kind of location data as well. With both of them off, I always wondered why Angry Birds used to advertise for bicycles in Atlanta, Georgia, considering I really need a bicycle somewhere in Norway, but apparently some ad servers can guess your location from which DNS server you use, and I used Google's DNS on my local network at the time.

Re:That's Odd

[Anonymous Coward]

Obviously, they've pegged you as a poor student - whether or not that's correct, it's the only advertiser who thought you were worth spending on, based on the data they got from you.

Personally, I fill out most BS "profiles" with $500K+/yr, unemployed, CEO, Female, Eskimo+Hispanic, 19 years old, divorced with 3+ children. You get some interesting junk mail that way, if you need to give them a correct address.

Re:That's Odd

[Grygus]

Unemployed CEO?

My liege!

Re:That's Odd

[PipsqueakOnAP133]

Or.... El Cazador de la Bruja
http://www.youtube.com/watch?v=_O2nPSddhJg

You don't have a Mac

[Anonymous Coward]

You obviously don't have a Mac

Pandora?

[Anonymous Coward]

Letting things out of my box?

hi guys i'm pandora

[Layth]

a/s/l????

Re:hi guys i'm pandora

[Anonymous Coward]

show us a pic of your box and prove it

How about people with paid subscriptions?

[Anonymous Coward]

I pay for Pandora... so I get no ads.
Not that I care if they are sending tokens of data to advertisers, I don't imagine there is some guy with a sinister black moustache wringing his hands at the other end. I'm sure it gets stuffed into a database and generalized. Just like those discount cards for grocery stores etc.

This is paranoid sensationalism. I hope anyone who complains doesn't have a facebook account.

Keeping It

[Necron69]

I've read the articles and seen what they are sending, and I don't care. With Pandora, I get all my music for free, and I'm willing to trade some info for that.

I remain curious as to how Android knows my gender, however. Sure, you could guess from my name, but I'm pretty sure there isn't a checkbox for "sex" anywhere in my phone config. Regardless, it wasn't a secret anyway. :)

Necron69

Re:Keeping It

[Anonymous Coward]

You probably gave this to them when registering for Pandora. Sex: M/F/None/Freaky

I personally...

[zimboptoo]

Haven't updated the app since it started asking for "Personal Information" permissions several months ago.

I'm rather curious as to how the app is supposed to be determining my gender/sex in the first place. Algorithmically based on the songs I listen to? If so, all those Glee songs I upvoted are probably throwing it off.

iphone location from gps, or profile?

[HungryMonkey]

I'm actually interested to see the hard facts on this concerning the iphone. When I pull up my location services on my phone it claims to list all of the applications that have requested my location in the past 24 hrs and pandora is not listed. I always thought the geographic data was pulled from my profile, mostly because all my ads are based on Chicago products, though I haven't lived there in 10 years. And yes, lets be honest, why would I my actual information in my profile? When signing in Pandora states that "Pandora may use your device model, ID and system version to personalize listening and advertising". Nope, nothing about geography...

Re:iphone location from gps, or profile?

[tlhIngan]

The simple question is - when you run Pandora, did you get a popup asking if you wanted to let Pandora access Location Services?

It's a popup that's generated by CoreLocation itself when an app tries to initialize it. And apps can't readily bypass it because GPS may not be available period (CoreLocation has several methods of determining location - the GPS will get you the best coordinates, but non-GPS equipped devices (WiFi only iPads, iPod Touches) can attempt to use WiFi triangulation.

pandora one?

[Anonymous Coward]

does the pandora one application still collect this data? I know it doesnt show the ads, but im betting it still collects and forwards the information.

What about paying subscribers?

[Manfre]

I'm curious if paying subscribers are also having their privacy raped by Pandora. Most likely, but it would be nice if they didn't.

Revenue Sharing

[Anonymous Coward]

If anyone making money off of my usage statistics would care to cut me in on the deal then I'm all for it. If you're just pimping my data without giving me my cut then (E+G)/2 you. Bye Bye Pandora. I'll get my Pixies fix elsewhere.

sigh...

[Isaac Remuant]

What about detailed ingredients in the food you buy? Warning for genetically altered food? Is that for stupid people also?

You sound like such a tough guy, though... You must be really awesome.

Re:sigh...

[fangorious]

That's a bad analogy though. Apps in the market give a detailed list of all permissions the developer has requested, just the same as a detailed list of ingredients. And in both cases you must accept all or nothing. I can't buy my favorite brownie mix without the corn syrup. I can either buy that brand or not buy that brand. I can either accept all the requested permissions and install the app or not accept the permissions and not install the app.

Re:sigh...

[Dishevel]

Do you even feel bad that you attacked my post without reading it?

Re:sigh...

[cheeks5965]

That's not fair. the OP wants the ability to allow or deny certain permissions. That's like saying, I'll buy your food but I don't want chicken in it. I think everybody would be in favor of specific lists of permissions.

I agree with Dishevel. If you want a free app but don't want to give the author the tools he needs to make money, then don't get the free app. If you want the new britney album but dont' want to pay for it, then don't get it.

Re:sigh...

[Gutboy]

So where are the non-free apps that don't ask for permission to everything on the phone? I don't see them out there either.

Re:sigh...

[Isaac Remuant]

I do read but I disagree with your arrogance and your insults on people who'd like to be able to customize whatever intrusions seemingly free apps make on your life.

The "take it like a man" answer doesn't solve people's problems.

If I haven't read your post I wouldn't have noticed the trolling attitude within it so I responded in consequence.

Re:sigh...

[Isaac Remuant]

Yes, analogies are usually bad and you're right.

There are a couple of problems though:
1) The user might not completely understand what information he is surrendering to the app.
2) Apps will take advantage of this and demand broad access and control instead of specific, customizable access to different things.
3) If people can't manage to allow only what they want all apps will do this and, contrary to what Dishevel the tough guy says, you won't be able to find non invasive apps (free or not).

Instead of being sneaky

[Stan92057]

Instead of being sneaky,breaking privacy laws, why the hell don't they just ask what products you would like advertised? And just because they can spy doesn't make it right or wanted. It should be an opt-in choice and always upfront

Wow. so very inaccurate

[way2trivial]

"Any app that uses internet could find out where you are by your ip address"

Do you think your ip address changes from tower to tower or something?

On the level of this topic- the locations being sought are on mobile phones, that in a given day could be anywhere in a 300 mile radius of start point at the extreme, 50-70 miles in a given commute easily.

The advertisers that want your location, want to know what restaurant you might be near for example.

and you think this can be determined simply from a cell phone IP address?

--whips out phone book...Layer,Lawyer-there it is

[gearloos]

OK, time to sue. We need to not just spank these guys with a nice hefty fine which will go towards keeping our incompetent government officials being paid for doing what they don't do, we need to sue these guys and actually put them out of biz. If I was to sneak into your house and copy information from papers on your desk, I'd be in jail. You know whats going to happen here? Nothing. Just like every other fkng internet crime by a company or corporation. They just offset the cost of the fine and roll it out of dividends and the stock goes down for awhile. Please... give me a break.

Betrayal

[ThatsNotPudding]

Weren't these the same plucky underdogs who begged right-thinking, savvy freedom lovers to come to their defense against the evil MAFIAA trying to shut them down though usurious fees? And this is their reward? Thanks for nothing (and all the ads).

Privacy Blocker already does this...

[chemindefer]

Sends junk data instead of true data for any app.

Blackberry?

[Anonymous Coward]

I tried to install the Google Maps application once on my Blackberry 9700 Bold and it wouldn't allow me to customize application permissions in the usual way. I was surprised and canceled the install because the Bold normally gives me alot of options to lock down what information is being shared, and I like it that way. I don't currently use Pandora (despite the recommendations of my friends) and I was wondering, does anyone know if the issue in TFA works the same way on a Blackberry as it appears to on the iPhone and Android OS?

Anybody using a Blackberry have any info on this? Pandora seems like a pretty awesome idea/service, but my participation in the digital community overall stops at volunteering my GPS location information to 3rd party applications and their developers, among other things.

For paid subscribers

[Kral_Blbec]

I wanted to know how it worked with paid subscribers, so I pulled up the privacy inspector app (which I've never used before so can't vouch for its worth) and scanned pandora. The only permissions it uses are the device ID (for auto login), network type and network status. Seems reasonable to me.

Pandora is saint compared to Talking Tom

[Anonymous Coward]

Talk Tom, Flixter, Text Plus+ and list goes on..
All these Apps vacuum up everything they can through the API and sell it to everyone on the planet who are willing to play.
"Free" really means you are free to bend over.

It's the Ad Networks

[Kaleden]

If you've ever developed for iOS or Android and wanted to release an ad-supported app, then you're probably aware of the plethora of mobile advertising networks available. The APIs they distribute determine what data is used to serve an ad. Some ad networks only require internet access, but others want location, tasks, phone identity, and/or phone state. Often, the networks that seek more data generally provide developers with more ad revenue. Do men want to see ads for vagisil and maxi-pads? Maybe, but chances are they wont click on those so why waste the time and bandwidth serving irrelevant ads? The more permissions an ad network requires, the more targeted an ad will be... or at least, that's the theory. These data are generally harmless and if they're not collecting your phone number, address, or email address, then it's not like you'll start receiving spam and junk mail. Honestly, Facebook gathers way more identifying information than these apps. Sadly, the number of ad networks that only require internet seems to be dwindling. I don't know whether using these data to seed ads has any impact on click-through-rates, but if they do, fighting for fewer permissions is going to be an uphill battle. If you're really worried about such permissions, check to see if there's an ad-free alternative and pay for it.

Pandora Gone

[Nom du Keyboard]

Pandora is now gone from my Android phone. It is only unfortunate that the uninstaller I used didn't allow me to send them a profane nastygram in the process. It should be labeled MALWARE in the apps store.

Re:I personally...Glee

[Nom du Keyboard]

Actually all those Glee songs may be outing your orientation. :^)

*sigh*

[Celestialwolf]

Uninstalled the app, gave a negative review referring to this grand jury investigation, and upvoted all the other negative ratings for this privacy issue. I'm sure the damage has already been done, but this at least makes me feel better and hopefully hurts Pandora's reputation a bit.

More than just demographic information

[Anonymous Coward]

Pandora is gathering and distributing more than just birthdate information. The ads that I'm getting are for wedding vendors in the own where I'm getting married - which is not my current location. This information is very private, and only available through my e-mail or access to a secured website. This makes me think that the information gathered goes far beyond the scope of what is described in their agreement.