Slashdot Mirror
Why Users Don't Trust Mobile Apps
snydeq writes "Fatal Exception's Neil McAllister writes of the growing unease among consumers around mobile data privacy, and how this distrust will impact mobile app development. 'When every week seems to bring another news story about a data breach resulting in the theft of customer data, customers are growing increasingly jealous of their privacy. Given the unique nature of the data to be found on smartphones, it's only natural that they have begun to view mobile apps with a skeptical eye. If you're developing apps that use customers' mobile data, you need to do more than recognize these realities. You need to develop a policy that places secure, ethical, and appropriate handling of user data at the core of your application development process.'"
It's almost as though downloading random apps from the Internet to run on a device you use for personal information might be a bad idea.
People might worry about their data stored in their mobile phones, but what worries me more is that they forget about the built-in microphones and cameras.
I see this as having a huge impact for the market for apps and what kinds of apps can be developed.
The situation is developing where users don't want to give apps access to anything on the phone other than the data pipe, except for maybe a mapping application or something with an obvious need. This is really going to limit where apps can go.Because of the sins of Apple (and others), people don't trust the platform as much as they used to.
Instead of being a device we voluntarily turned over information to in order to expand its role in our life, we are starting to see it as something that needs to be reigned in, controlled, watched like a hawk.
Formerly people happily used Windows and IE to bring the internet into their lives. Now these are items you don't trust, you run several other programs on top to police them, etc.
It's really a shame that this greed for personal information to sell has set back the role that palmtop tech may otherwise have headed toward in our lives.
I'm just a Cube Runner and I don't have a degree in Physics but I don't want some stranger to Take Me to My Car by reading my location file.
Yelp! I'm going to have Words with Friends and dance the Fandango if they have been sharing my information. I may use Device Locater but I don't want others to. Siri ously. They can build their own Empire and Tunein to their own location data but not mine!
She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
I'm too young to remember, but surely data breaches with computers, when they were new, were met with the same reaction? Smartphones came to the forefront less than five years ago. I'm personally pretty surprised this issue didn't arise sooner.
"If you're developing apps that use customers' mobile data..."
How about not writing mobile apps that store user's data?
Very few apps need to store user data. Companies aren't using the data because the apps need it. Their ad stream needs it. Which reminds me: if you're not paying for a product/service (google, facebook, slashdot, reddit, etc.) you're not the customer...you're the product.
Old & Busted: Shareware
New Hotness: Low Orbit Privacy Cannons
Why are we simultaneously whining about threats to national security and purposely tricking users into leaking sensitive info?
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
Why shouldn't everyone else?
A feeling of having made the same mistake before: Deja Foobar
This article is just wrong. People will give up almost everything about them on FB to be able to plant a crop or raise a barn or do a hit on a rival gangster. Have you ever looked at some of the information the random apps capture(or have access to?). It’s the same practice but to turn on a flashlight or get a game that goes blip blip blip. Give them a toy for Free and they will open their lives to you in an instant.
Is it possible that people are discovering that life isn't all roses and sunshine inside the walled garden?
Perhaps people actually like to be able to have some amount of control over the things that bought and paid for?
I wasn't sure this day would ever come. I think I'll go and celebrate with a nice walk to a neighborhood restaurant.
Seriously, I'm pleased if this is really what is happening.
---
"I can't complain, but sometimes still do..." Joe Walsh
When every week seems to bring another news story about a data breach resulting in the theft of customer data, customers are growing increasingly jealous of their privacy
Project much? As long as you aren't losing CC data, people are as unconcerned as they ever were. The rapid growth of Facebook is exhibit A, and enough to close that argument down.
Not that app makers should not strive to protect a users privacy anyway, but it's a very small (yet vocal) minority of people that are attempting to paint this as a Big Issue.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Maybe if Apple and Google incorperated a firewall it would fix thing. Most apps don't need to connect to the internet, so the firewall would disable apps from connecting to internet on a case by case basis.
Burn the Contract Break Fee and then do a prepaid plan.
The point of a Smart Phone is the features and the "boring" apps like the calculator, and the nicer rendering in Safari. I despised my dumbphone with a passion - I don't call anyone much.
"Apps" themselves are brilliant - people often only have 7 must-use features and don't need $80 programs to cruise through their day.
Also Apple made the entire industry wake up and pay attention to UI for once.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
the biggest breach lately is by far the sony playstation, in the cloud the place with most personal data is now facebook, in the cloud the personal emails are in typically in the cloud documents and address books are going to the cloud fast while a phone may get stolen or lost, the big things are on the net an easy solution about mobile devices are to have the data be wiped when away from the user, and then just pull what is needed back when the user is close chrome laptop is one example of this, and new phones could be made the same way, could easily respond to an rfid chip in the clothes or purse
Makes a good point for GPL licensed software, now doesn't it?
* Carthago Delenda Est *
Who the fuck are you lecturing ?? Go to the fucking supermarket and 100x more is captured and stored on your doings. You are a fucking idiot is what you are !!
Android already has a great permissions system by which an application is granted permission to access functions of the phone and the Internet connection on a fairly granular level.
However, even though they have already implemented this system that could allow the user to control what an application can do on her device, Google has chosen to restrict the end user from obtaining greater privacy and security by restricting an application's permissions. Through the user interface, one must either grant all permissions to an application or choose not to install the application--a single permissions cannot be removed.
There is a small argument to be made that this makes things easier for developers, but how hard is it to gracefully handle not having certain permissions? For many features like GPS and Internet connectivity, Android could simply respond as if they are turned off if permission is denied. Some members of the Android development team have tried to spin the lack of user permission settings as a benefit to the user with the argument that "if users can disable permissions arbitrarily, then developers will have no incentive to minimize the amount of permissions they declare their applications need, and the average user will be less secure". This is the only somewhat rational explanation I have gleaned from there responses, and while there might be a small bit of merit to that and certain developers might really believe that, I think on the whole it is misguided.
I believe Google's real goal is to make sure the user has no control over permissions, only a binary install / not install, because they're an advertising company with an interest in your data being sold. They continually ignore this permissions issue even though they have acknowledged it is among the top Android security complaints.
I am one of those "very jealous" users of my privacy (as I am guessing many other Slashdot users are as well). One of my biggest concerns are apps like Facebook or the Twitter app on the Android phone which get full-blown access to your device - AND THERE'S NOTHING YOU CAN DO ABOUT IT. Short of rooting my phone and removing the apps (which, in and of itself presents another security issue), these apps are automatically installed, get full access, and cannot be removed.
I like the Android platform, but this is one thing in particular that I cannot stand.
How about the smartphone OS developers providing more granular control to the users to allow/restrict apps' access to specific functions?
Edward Burr
Having a smoking section in a restaurant is like having a peeing section in a swimming pool.
and they trust the app store. You just need a trusted central authority reviewing everything. My Firefox Plugin has a binary component in it to make the MP3s, so every time I submit a new version it takes a week or two to show up on Mozilla's site, but the awesome thing is they review it for me so that my users don't worry I'm trying to pull a fast one.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Lets be honest, there's no accountability on the part of mobile app developers. Before you download an Android app it asks for permission to use certain features, but the developers aren't required to say how they'll use those features, or what they'll do with it.
And what's worse is that despite having a fairly granular permissions system, the end user is totally denied any ability to selectively remove permissions. Want to remove Internet access from an application that doesn't need it? Tough luck--Google knows what's best for you.
And then they try to say they don't add this because 90% of users wouldn't use it. So? Bury it deep down in a menu somewhere that only people that really care will find it. The fact is it would be simple, but Google just doesn't want the user to have this power over her device.
See more from me on this below.
the amount of currency I paid the carrier to give me the phone in the first place.
That would be $200 to start the contract and $350 to terminate it early. Are you including the ETF in the effective price of the phone or not?
Not only is privacy an issue, there is the fact that the app may be nonexistent when you go to use it.
Proverbs 21:19
Burn the Contract Break Fee and then do a prepaid plan.
Which U.S. prepaid smartphone carrier do you recommend? I looked at Verizon's prepaid plans, and some of them were more expensive than contract plans. Is the Samsung Intercept on Virgin Mobile USA any good?
1) Report your location
2) Perform any financial transaction
3) Scan UPC and other computer codes
4) Has a camera, sometimes front and back
5) Can pick up sound and conversation
and... (Drumroll please) report all this back to a central authority anonymously. The ghost of Stalin must be green with envy. And the best thing is, the people actually pay for this themselves!
What next, a site that compiles all personal information of all suspected subversives, er, "friends" and the people those "friends" are connected to?
No, wait...
Please do not read this sig. Thank you.
Could someone please build an open mobile platform? I know, I know, you say the US federal gov. won't let us because they want to spy domestically. I'd just really love a mobile device that ran linux, and was mine. That is to say, not some jack-off phone with a protected boot loader and onboard encryption chip which the manufacturer claims is for my protection. We all know that drill, you want control. And not Android which I'm rapidly growing weary of. I'm tired of the screen ... "This app wants to sift through your bank account, tax returns and your wife's panty drawer. Would you like to allow this? Please select: ."
and the fact that most of the time I'm near PCs anyway
When I'm on the bus to or from work, I'm near a PC (my laptop), but this PC doesn't have Internet access. Some people subscribe to mobile broadband for exactly this use case.
T-mobile
I don't want to rely on a plan that AT&T will more likely than not cease to offer once it completes its acquisition of T-Mobile USA.
in many cases this software exists and is free, it's just not ported
How easy would it be to port a substantial application from Windows to Android? As I understand it, a lot of the toolkits on which an application relies might themselves not be ported.
or in the store
There are three stores on my Archos 43 Internet Tablet: AppsLib, which came with it; Android Market, which I installed with ArcTools; and Amazon Appstore, which I installed by downloading its .apk. The stores have different criteria for inclusion and different overheads on each developer's part. Which store are you referring to?
This is all caused by the fact that android uses fat32 for the sdcard instead of a real linux filesystem.
Which in turn is caused by the fact that Windows out of the box is incapable of mounting "a real linux filesystem" on the USB flash drive that an Android device emulates.
In reality... the awareness simply isn't there. The all-or-nothing approach taken by Android doesn't help much: because you have to grant every requested permission or deny the app entirely, android installer is simply another form of windows UAC: it encourages people to click 'yes' without considering the consequences. You might have some vocal minority speaking out against excessive permissions requests, but most are just going to click through so they can get to play with their dancing bunnies, flying farm animals, or whatever else catches their fancy.
Unfortunately, the piecemeal approach taken by RIM isn't much better: consumers can get prompt for almost every specific permission the application requires -- but there's really little detailed explanation of how those permissions might get used.
Ideally we'd see RIM's fine-grained permissions combined with Android's detailed explanations -- and still get the same result of automatically allowing ;)
Until users get burned by privacy issues, they're not going to pay attention to them.
Consumers should first be made more aware of their own culpability in privacy violations. Many mobile users compulsively send out their personal information through multiple Social Media apps without any care as to who might be on the receiving end.
And any policies or controls that may be placed on mobile devices to protect these people from themselves will inevitability be disabled and circumvented if it in any way inconveniences them from getting their Twitters or Foursquare updates out to the public.
Since I learned that AdMob sends my location data tagged with the Unique Device ID of my phone to Google, I'm very much wondering if even Google has actually realized that there may be problems with that approach. WP7 sends the very same data that the iPhone saves into its local database right home to Microsoft, also with the Unique Device ID.
It's not just the apps, really.
Has anyone written an app for android that let's the user set permissions?
Right now I'm using the app Droidwall (free and excellent) to firewall all apps except for the handful that I want to be able to phone's data/wi-fi connection - such as FireFox. This is obviously not the same as permissions management, but it's better than nothing. Any other suggestions?
These things could be done by custom ROMs and I'd be surprised if they're not already being done by somebody.
It's not in any ROMs yet, but a patch is being considered for inclusion in Cyanogenmod 7.1 [javascript required]. Here's the related issue thread.
It will be great if this is included in custom ROMs, but I strongly feel one shouldn't need to void the device warranty for this simple, important, easy-to-implement feature. Google has no (good) reason for failing to include this in AOSP, and this is becoming more apparent by the day.
Has anyone written an app for android that let's the user set permissions?
One exists: Permission Blocker. Though it likely still has bugs and there hasn't been an update from the developer for a while.
I've tried it personally, and it works as described, although it doesn't seem to read packages XML perfectly (it failed to list the permissions for Firefox, though all other applications on the test device listed their permissions, which could be disabled). It requires root access and a reboot after each change. Denying some permissions forces applications to Force Close because they don't know how to deal with the denial from Android.
The Cyanogenmod team is taking the more complicated and functional route of providing acceptable responses applications will accept for denied permissions. A patch has been submitted [javascript required] that might be included in Cyanogenmod 7.1. Looks like there was a lot of activity just three days ago.
Miami call girls
Animal House is Miami's premier Escort Agency. Our Miami Escorts are ready to show you a great time! Our Miami escort agency offers the customer an option for an hour visit, or a full day's visit to enjoy all that South Florida has to offer. Start your day off right with a breakfast at one of our well known restaurants like the Courtyard Grill, or Big Pink and then head for South Beach. http://www.animalhouseescorts.com/
*UGH*! such naivete...
Networked devices are insecure, and those insecurities will be exploited. That's all that needs to be said. Everything else is pure bullshit..
For justice, we must go to Don Corleone
I hope you are killed soon. Dismemberment might not be enough. Maybe a thousand papercuts so you can bleed out, and shortly before you expire, then dismembered with a chainsaw.
People paid for the Playstation Network. They walked into a store and paid a LOT more than $50 for a box. I don't hear any of them lauding the uber awesome privacy of pay-vs-free.
Free doesn't include your credit card number. How's that for privacy?
I8-D
TFA has no evidence what-so-evar to back up its claim that people don't trust mobile apps any more or less than they do any other type of app (hell, even freakin' MS Office asks if you want to supply "anonymous data" to Redmond). Well, unless they're saying that "prominent lawmakers" == consumers.
This is just some random journo opinion. You'd have thought it would have maybe fired up Surveymonkey or something for some attempt at a citation.
"And the meaning of words; when they cease to function; when will it start worrying you?"
In fairness, every ad supported app requires network access for downloading apps [ads?]. If you take that away, we as consumers like it as it's a quick and dirty ad blocker, but the advertisers and ad-supported app developers would get the short end of that particular stick.
Or we could, you know, go back to a traditional thing called advertising, and the developer could include some ads in the APKs that don't require internet access. As opposed to what's going on now, or in other words "compile lots of your personal information and activities in a database in order to profile you and sell the data and results to the highest bidder". There's quite a difference, but I think the common person sees the ad as an annoyance rather than the privacy minefield being planted behind it.
And it's an endless path that just pushes itself onward, too. The personal demographic-targeted ads devalue the traditional ads. The geo-targeted demographic-targeted ads devalue the plain targeted ads. The geo-domestic-targeted ads that analyze and report your network of friends and contacts push the value of others further toward 0. And so on.
There's a limit to what the "value" of an ad can be, and as we develop new ways to make them more personally invasive, we only create a little more "value"--what we mostly do is render the traditional ads worthless, in such a way that they are no longer profitable enough to support anything.
Yes, some people have filed a class action suit against Apple, and a few Senators have been asking questions. That may put people off for now.
Wait six months, and see if there's any remaining distrust in the general population. Once the media has been quiet about the issue for two weeks (and /. is not media in this sense), people will stop forgetting about the fuss. It's all rather abstract, and most people aren't good at foregoing convenience for abstract reasons. Other people will think it's been dealt with (and Apple is updating iOS so it doesn't retain location information like that, so there's some truth to that).
We're talking about people who don't understand the issues and the technology. People who fall for "click on this" or "install this toolbar" offers all the time. Why do you think they'll care about this as much as industry analysts do?
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
...because I can't block the ads in them like I can in my browser (Mercury Browser on iPhone).
Before you go ahead and violate it anyway...
I also don't any application as they may be sending my phone data to any third party server just like APPLE/ANDROID. I always like web based application which can be access from any phone or PC. Even you loose your phone but your data is maintain at the server. Currently, I'm already using such a web based application http://fonet.mobi/ which has lots of feature like sign sing-on to linkedIn, google Buzz, facebook, twitter etc, maintain your contacts, mini blog, bookmarks, rss feeds etc etc...I can't describe all the features .. its worth to check it out. They may not have very nice interface like iphone but its works very well on many phone.
Then there's the "Save the Children" bunch (ever check out their directors????? 'nuff said on that one). And how about the Red Cross, structured as a global money laundering operation (how many pennies per ever one thousand donated are actually used???) and what can you say when their director meets several times a year with Henry Kissinger, Richard Perle and David Rockefeller???? (Not my kind of people, that's for sure!)
Microsoft's DOWN TO 5 UNPATCHED SEC. VULNS IN THE ENTIRE MS PRODUCT LINE YOU USE TO DO BUSINESS ONLINE: (& 3.5x less unpatched security vulnerabilities than Linux has, no less, in its "latest/greatest", albeit KERNEL ONLY (makes a difference, read on)):
---
Vulnerability Report: Microsoft Office 2010: (04/29/2011)
http://secunia.com/advisories/product/30529/?task=advisories
Unpatched 0% (0 of 4 Secunia advisories)
---
Vulnerability Report: Microsoft SQL Server 2008: (04/29/2011)
http://secunia.com/advisories/product/21744/
Unpatched 0% (0 of 4 Secunia advisories)
---
Vulnerability Report: Microsoft Internet Information Services (IIS) 7.x: (04/29/2011)
http://secunia.com/advisories/product/17543/
Unpatched 0% (0 of 6 Secunia advisories)
---
Vulnerability Report: Microsoft Exchange Server 2010: (04/29/2011)
http://secunia.com/advisories/product/28234/
Unpatched 0% (0 of 0 Secunia advisories)
---
Vulnerability Report: Microsoft SharePoint Server 2010: (04/29/2011)
http://secunia.com/advisories/product/29809/
Unpatched 0% (0 of 0 Secunia advisories)
---
Vulnerability Report: Microsoft Internet Explorer 9.x: (04/29/2011)
http://secunia.com/advisories/product/34591/
Unpatched 0% (0 of 0 Secunia advisories)
---
Vulnerability Report: Microsoft Visual Studio 2010: (04/29/2011)
http://secunia.com/advisories/product/30853/?task=advisories
Unpatched 17% (0 of 6 Secunia advisories)
---
Vulnerability Report: Microsoft DirectX 10.x:
(04/29/2011)
http://secunia.com/advisories/product/16896/
Unpatched 0% (0 of 3 Secunia advisories)
---
Vulnerability Report: Microsoft .NET Framework 4.x
(04/29/2011)
http://secunia.com/advisories/product/29592/
Unpatched 0% (0 of 3 Secunia advisories)
---
Vulnerability Report: Microsoft Silverlight 4.x: (04/29/2011)
http://secunia.com/advisories/product/28947/
Unpatched 0% (0 of 0 Secunia advisories)
---
Vulnerability Report: Microsoft XML Core Services (MSXML) 6.x:(04/29/2011)
http://secunia.com/advisories/product/6473/
Unpatched 0% (0 of 4 Secunia advisories)
---
Vulnerability Report: Microsoft Windows 7: (04/29/2011)
http://secunia.com/advisories/product/27467/?task=advisories
Unpatched 8% (5 of 59 Secunia advisories)
AND, of those 5 vulnerabilities, yes... 2 are still "remote". HOWEVER, they have EASY work-arounds (basic "don't be stupid" stuff everyone OUGHT to practice & be aware of).
They can be avoided by not just downloading & running "anything" etc. (being utterly stupid in other words, or just ignorant (which in the case of a child, I could excuse (not an adult)).
I.E.-> "NO PROBLEMO!"
&
3.5x LESS THAN IS PRESENT ON THE LINUX 2.6x KERNEL ALONE (toss on the rest of what goes into a Linux distro? That # goes "up, Up, UP & AWAY...", bigime, "increasing that lead, that Linux has", lol, in more unpatched known sec
So if Google won't help us solve our issues with the lack of fine-grained permissions, why not take it into our own hands?
Has anybody written a mod for a (rooted) Android phone that will
- allow the user to install apps that require "full internet access," but ensure that those apps get no real access outside certain URLs (and log access for accountability)
- allow the user to install apps that require GPS, but ensure that those apps receive no real GPS data
- allow the user to install apps that require SD card access, but ensure that those apps have no access outside a certain sandbox directory
- cameras etc etc etc
Just for "good measure" (both ZERO/0 unpatched KNOWN security vulnerabilities also):
---
Vulnerability Report: Microsoft Forefront Endpoint Protection 2010: (04/29/2011)
http://secunia.com/advisories/product/34343/
Unpatched 0% (0 of 1 Secunia advisories)
---
Vulnerability Report: Microsoft Virtual PC 2007:
http://secunia.com/advisories/product/14315/
Unpatched 0% (0 of 1 Secunia advisories)
---
Nuff said, in addition to my 1st post here -> http://mobile.slashdot.org/comments.pl?sid=2114448&cid=35981128
APK
You're arguing two points. An ad that tracks user data beyond the intent of the app (e.g. Google Nav needs to know where I am as a core component of its functionality, as does FourSquare [not that I use it]) is a bad thing. Traditional ads are a good thing, as is keeping them relevant. No sense in advertising a movie that's no longer in theaters, or rolling out new apps just for the sake up updating the ad packages, or making the APKs triple the size for the sake of bundling ads. Streaming ads from an ad server is an acceptable practice for a program that is free.
I agree with the fact that devaluing traditional ads is a bad thing, as is the extremely targeted ads that seem to be the growing trend. My point is more that network access to pull generic ads or coarsely targeted ads (i.e. a free SSH client advertising Rackspace or Kace given the inherent demographic that would download an SSH client in the first place) is acceptable to me. Making it possible for those devs to lose their revenue like this is not, but neither is the scenario you paint.