Slashdot Mirror
More Than 25% of Android Apps Know Too Much About You
CowboyRobot writes "A pair of reports by Juniper and Bit9 confirm the suspicion that many apps are spying on users. '26 percent of Android apps in Google Play can access personal data, such as contacts and email, and 42 percent, GPS location data... 31 percent of the apps access phone calls or phone numbers, and 9 percent employ permissions that could cost the user money, such as incurring premium SMS text message charges... nearly 7 percent of free apps can access address books, 2.6 percent, can send text messages without the user knowing, 6.4 percent can make calls, and 5.5 percent have access to the device's camera.' The main issue seems to be with poor development practices. Only in a minority of cases is there malicious intent. The Juniper report and the Bit9 report are both available online."
Or know too little?
Oh wait, that's the users and designers.
If only there were some way for me to tell which permissions an app will use when I install it!
I've installed LBE Privacy control and it blocks unnecessary permissions for many apps. Why does a keyboard need internet access? The only thing I'm concerned about... What does LBE know, and what does it share?
I have an S3 and downloaded a few apps. Before installation you're told what permissions the app wants on your device.
E.g. the Facebook app seems to want every permission it can get it's grubby hands on thus I've chosen not to install it.
Unless app developers are using workarounds.
Funnily enough it is no surprise that many of the "free" apps seem to want the most permissions.
They should add more fine-grained permission, so that for example an application would only require 'access to add-server' instead of full network access. And please make some clear policy that gets enforced, i.e. applications that do ask more permissions than they need get banned until the problem is fixed.
karma police: arrest this man, he talks in maths; he buzzes like a fridge, he's like a detuned radio. [radiohead]
for using iPhone apps.
It's unfortunate that apps' knowledge of you is granted with a nebulous single-screen laundry list and OK button, similar to the click-through EULAs of what seems to be a bygone era.
Yesterday's legal violation is today's privacy violation.
We need a website listing apps and what persmissions they require vs use.
Developers will start paying attention when their apps are publicly shamed.
Lets have a little balance
http://www.huffingtonpost.com/2012/02/15/iphone-privacy-app-path-facebook-twitter-apple_n_1279497.html?ref=mostpopular
Facebook, Twitter, Foursquare, Instagram all send email addresses and phone numbers to their local servers.
The whole thing blew up and ended up with US congressmen sending letters to Tim Cook. This was feburary this year
"This incident raises questions about whether Apple’s iOS app developer policies and practices may fall short when it comes to protecting the information of iPhone users and their contacts."
Butterfield and Waxman then quote parts of Apple’s iOS developer website which states that Apple provides a comprehensive collection of tools and frameworks for storing, accessing and sharing data. It is then questioned whether Apple requires apps to request user permission before transmitting data about a user."
I wish I could use "optional" permissions. If the user doesn't want to give me access to something, that's fine. But if you want to integrate a whiz-bang feature that requires SMS, you either scare off people or have to make a separate app.
You really don't. I trust andriod better this way.,
That study is irrelevant. Most of those apps don't know that because they need to, but because they are free and the averts do.
Do the same study on payed apps. For example, GPS location access is not present on any of the games I bought so far.
You get shown the permissions right before you download an app, but you don't ever get told why an application needs these permissions.
Ideally an application's description would contain something like a privacy policy that describes what it does with each permission. For example:
I've already seen several applications on Google Play whose descriptions have permission rationales like this near the end.
Why does a keyboard need internet access?
An input method might need Internet access to download autocorrection dictionaries for multiple languages, or to download messages from sponsors to keep the application free for you to use.
The way things are setup on stock android is a nightmare. The supposed "Walled Garden" doesn't even exist. Android doesn't have malware/viruses because "legit" apps can walk right in and do whatever they want. Want to steal all your users contacts and use them for spam? There's a built-in API for that.
I was trying to download a widget for screen brightness and 99% of the free ones wanted internet access permissions. It was just absolutely atrocious.
The only redeeming feature is how easy it is to root and fix.
I really like the name that phk (of FreeBSD and Varnish fame) came up with for permissions required for apps like that: chernobyl bits.
It has a really nice ominous and "this is wrong and you shouldn't do it" ring to it.
________
Entranced by anime since late summer 2001 and loving it ^_^
That operating systems like iOS and Android even give someone the ability to see that certain permissions are required, and by the compliment, that there are permissions that are not required, is a step in a good direction. That granularity feature is absent in desktop applications--essentially all permissions are granted by default. For all I know pkunzip could have been keeping track of all those file_id.diz it encountered in order to build a profile of me, then dialing some BBS to upload the statistics to. That might seem implausible, but since there was no central authoritative repository to download pkunzip, it came from a BBS. That BBS could have replaced it with its own custom version for tracking.
The larger point is that desktop programs could have been doing for years what people are worried about with tablet and phone applications.
That said, it still creeps me out to see a solitaire game needing access to my address book. Maybe this is a case of "out of sight, out of mind."
Then perhaps the developer should submit each dictionary as a separate application. The user would install the specific language's dictionary as an application, and if that application detects that the IME is not present, it would direct the user to install the IME from Google Play Store using a market intent.
one that is the smartphone (portable computer) and that will not have sms, cell service, address book, etc. rooted and firewalled and monitored.
2nd phone would be a dumb phone that has no networking at all in it, simply just to send and receive voice calls.
until there is a hard boundary (enforced, like a true barrier) between the soft apps and things that can cost you money (dialing out, stealing your contact list or local data), it just does not seem worth it to bundle all your stuff into one box.
sure, its convenient but the trust model is not good enough.
more and more, I just leave the smartphone home and use it as a wifi only device. at least I know that no sms BS is coming thru and no outgoing calls or wan connects could ever happen that would be costly or info-leaking.
seriously, I'm demotivated to invest more of my personal info on a box that I have less and less control over.
--
"It is now safe to switch off your computer."
100% of smartphone apps know nothing about me, except the ones that I've made myself.
I root all of my Android devices and install the DroidWall app. It allows me to block network access to any app regardless of whether you give them permissions when installing. It's allowed me to download and use many apps that I would otherwise not have used because they wanted network access. It even lets you decide if you want to block the app on WiFi, cell data, or both.
In life you hoped to do what you could but mostly you did what you were told and that was the end of it.
Oh noes 45MB! of my 32GB of storage.
Phones running Android 2.x (FroYo or Gingerbread) are likely to be partitioned with 512 MB for apps and the rest for SD card. Only by 4.x (Ice Cream Sandwich) did Android phones switch to MTP for PC file transfers so that they don't need a separate partition that can be unmounted while the phone is connected to the PC.
It would take seconds to download that information over LTE, seconds!
LTE is for burst transfers, not for sustained transfers. Assuming a cap of 5 GB per month, a 45 MB download takes up about 6 hours of your cap (45 / 5000 * 30 * 24 = 6.48).
But why does a particular application need to 'take pictures and videos' if it's not primarily a camera application or to 'prevent phone from sleeping'? Better yet, why does the application need 'full Internet access'?
But how easy is it, under operating systems that come on home PCs sold in retail stores, to set up applications under multiple user accounts to display windows on the same screen? Secure won't get used unless secure is easy.
How do you think you get access to the flash?
How much clearer can prevent phone from sleeping?
Torch does not need full internet access.
How do you think you get access to the flash?
I didn't immediately see the connection between "take pictures and videos" and use of the flash. Perhaps Android should introduce a finer-grained permission "operate camera flash", and have "take pictures and videos" imply this.
I encountered an app that would do statistics on a picture. Said app actually uploaded the picture to a website, then pulled values back from that instead of calculating from the app itself.
An iPhone 3GS or iPod touch 4 might not have enough memory to complete the calculation or enough CPU power to complete the calculation in a reasonable time. It's for the same reason that Siri uploads compressed audio instead of attempting speech to text directly on the device.
Denying permissions to applications that expect those permissions would cause the applications to force close when Android throws a SecurityException. How do you think force closing like this would improve the user experience?
Fine don't do those things, but then you are probably on the wrong website.
As CronoCloud has repeatedly told me, Slashdot users tend to be extreme edge cases. People who ask questions as if they are on the wrong web site might be asking on behalf of family members or co-workers who are clearly outside Slashdot's core demographic.
I'm afraid of big corps than small application developers for giving my data. If a small company, or an independent developer gets my data and use it without my permission and that harms me, I can sue that guy or small company and probably protect myself. A painful process but doable.
On the other hand, I'm helpless against a big corp. I don't think there's any difference, since it includes profit and big corps can make more money out of it, in a way that big or small company can do with my personal data. Major problem is I can't fight with a big corp. I won't be able to have a energy and money to protect myself. They will do whatever they could do and I would be helpless.
It's important to educate people about the importance of their privacy, so there will be a common uprising against the big corps in case they do evil. People ignorantly trust big companies. They will accept any kind of pop-up, or warning you'd put and install their applications. Though they have no idea what could they do and what kind of power they have with these data after they get a big harm. There must be thousands of families or lifes ruined because of irresponsibility of privacy protection of facebook or google. Even I personally know couple of people affected by those. But I haven't heard any case these companies paid for their wrongdoings.
If you are running 2.x I feel for you. That device should be replaced by now.
Some U.S. carriers are still selling 2.x phones, especially carriers that operate on models other than subsidy. See for example Intercept, Chaser, Optimus Slider, Optimus Elite, and Triumph.
LTE is for all the time, that is why I have an unlimited plan.
Provided you happen to live in one of the major cities that has unlimited LTE.
On my Wifi it would take even less time than over the LTE.
Which may mean a trip to the restaurant.
How would your crap application handle a device that totally lacks whatever you are trying to access?
It would rely on having been blocked from installing. Android apps can state that a permission is required or that a permission is required unless the hardware doesn't support it. If a permission is required and the hardware doesn't support it, Android blocks it from installing. I have seen this with newer versions of the ZXing Barcode Scanner on my Archos 43 Internet Tablet, which requires the "landscape" permission that Archos mistakenly left out of its AOSP build. The same happened when I tried to install the official build of this scanner on my Nexus 7 which has a front camera but no rear camera. I had to download the "LearnPad Scanner" and "Nexus 7 Camera Launcher" applications, which are rebuilt to allow use of a front camera. So the only permissions that the user can disable without risking a force-close are features that 1. depend on hardware and 2. have been specified as optional.
A free one probably wants to display adds, I suggest you buck up and spend $1 on the version that does not.
The problem here is that Google launched Android phones in some countries before it launched availability of paid apps in those countries. So in order to reach users in those countries, developers had to make their applications ad-supported. This has led to an expectation on Android that applications would be ad-supported.
The problem I see is that, in order for most apps to do something useful. For example, if you develop an SMS app, besides permissions on reading/writing/editing/sending messages, you will need access to contacts data, phone state and identity. Looks scary, but no SMS/MMS app can function properly without these.
I've been developing a few Android apps and they almost all require some type of "unsafe" permissions to run...except one (a small puzzler game).
Similarly, many apps need internet permissions. You can still look at what the app does, and try to determine if it really needs all the permissions it is asking. But since the problem lies in how do the app creators use those permissions beyond their declared "privacy policy", the only reasonable solution I see, is to install a monitoring app for network access, as suggested by some posters...provided the app itself isn't spying on you...
This was the reason number one why I used to recommend CM, unfortunately this feature has been dropped in CM9, apparently the developers' time is better spent making yet another media player and yet another file manager.
I understand that some of those devs may need funding for their work and that the media player can generate some income, but I think CM has lost its roots: it was about empowering the user and giving a stock Android experience, now I'm not sure what it is.. but I don't care for those apps, I want stable (and if possible timely) releases that put me in control, if I want apps I will go to the market for that.
TODO: 753) write sig.
Part of the android system should be a block/permit window whenever an app tries to do anything restricted.
How did the public react to Cancel or Allow when Microsoft introduced UAC in Windows Vista?
Patents last way too long 20 years from the filing date is what it says .. but if the patent office takes long to approve it then you get to tack on that time too. There are still patents on HDTV that were filed in the 1990s that have not even been issued yet! When they get issued they will get about 18 or 19 years from the issue date. .. the patent system is a joke
Companies deliberately delay the approval of their patents to take advantage of this loophole. The loophole was made for pharmaceuticals (FDA approval can take a decade), but tech companies are taking advantage of it too. Couple that with the fact that you can now patent stuff that other people invented before you thanks to the change from FI to FITF
You know what permissions to allow a program by reading the ToS, (Terms of Service),
and I may be one of the few people that does this. The ToS will send you to their Privacy Policy
which is really what you need to read (Privacy Policy trumps the ToS).
With a Cell Phone or Tablet you have no control over your system, unless rooted which
I for one required, while I allow permissions, I also block them (HOSTS file).
(To the Anonymous Coward who showed me how to slip a HOSTS file through a rooted phone - thanks again)
The two most important permissions to me are superuser and Full internet access.
Allowing Tracking to me it's exactly dangerous but to me very close.
Using Angry Birds (rovio.com) is an example of abusing the full internet access permission:
Angry Birds Privacy Policy: http://www.rovio.com/Privacy
they use www.flurry.com for analytics
Flurry.com also has a privacy policy: http://www.flurry.com/privacy-policy.html
That you are agreeing to when you agree to Angry Birds:
Both parties (Angry Birds, Flurry-analytics) use web beacons
http://en.wikipedia.org/wiki/Web_bug to track everything you do while accessing
the network via your unrooted device.
Flurry.com knows when and who (you, your spouse, kids or which friend) checked
their email last from your Internet connection/router/WiFi. As they do collect identifiable information.
rovio.com also send "some" collected data out of country , other countries
aren't required to supply ToS's - so you no clue what's to become of that.
X-plorer is a good example using both of my important permissions and not one word
of how they handle data or if they even collect it, or if they are going to upload a program my way.
All of the above is unacceptable to me, it's beyond tracking and into following "for personalized ads".
The Target store for one may very well know your daughter is pregnant before you.
http://science.slashdot.org/story/12/02/17/1927229/how-companies-learn-your-secrets
The above is the norm for what the Cell Phone, Tablet, and such. On PC's one (I at least)
would never install something with those conditions. Games from the android stores
have some of the worst ToS I've ever read. While Angry Birds is a good example
ASTRO file manager reads the same way.
Hardware controls: Take pictures and videos
So you downloaded a flashlight, it's claiming it needs to "take pictures and video" and you are still claiming the explained need for that is not vague? How is an average non-technical user supposed to know that Torch needs to "be able to take pictures" because that's the API used to access the camera flash LED???
I mean the app could just as easily also be recording everything they do when it runs.
If you can't read plain english you don't need a smartphone.
Revised: If you cannot program you SHOULD NOT run Android.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I personally believe that the Android security model is a step in the right direction, but what it should do is allow the user to determine which of the permissions they will *allow* an app to use, not simply tell the user which permissions the app is *going* to use. This means that apps will need to be written slightly differently, but it may also mean that they will need to work harder to justify the permissions they need.
Okay, just making sure I understand what you're saying - you install an app on iOS, but it's totally dead in the water (i.e., no permissions to actually do anything) until the user actually engages the app for the first time, at which point it goes through the things it wants to do point-by-point, giving the user the option to not allow certain permissions, while allowing others?
You don't really understand it, but you are on the right track.
The application when you start it has no ability to access protected resources (Address Book and location and photos are protected). Network access is not a protected resource, but since it has no ability to see any of your data yet that does not matter.
Now you stated "go through the things it wants to do point by point" on launch. No, that would be stupid. How could the user know yet what made sense to allow? That is BTW the biggest problem I have with Android, it's insane to think a user CAN know up front what permissions make sense for any application, even a flashlight.
So then what happens is that as you use the application, it asks for permission as the need to access a resource comes up. So only within the app do you ask to use your contacts for something, would it bring up an alert asking if it was OK for that application to use your contacts. Only when the app was ready to make use of location would you be asked if the app should be allowed to see your location - and so on.
can you cite a source for this?
Well you could just ask any iOS users or developers since it's the way every app works. But here is just one of many stories.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Yes, absolutely, this is harder than it looks. Pay attention much? The problem is related to the phenomena of Decision fatigue.
Every time I go back to the Crap Store, my searches come up with applications I've already reviewed and rejected. Applications that in fact violate my express policy over which invasive permissions I'm willing to concede (let's not call it "grant") relative to the benefits derived.
Here's how it ought to work. Once I decide that messing with my address book is totally verboten, I should never again see an application listed in my app searches that requires this permission. I barely even know that such applications exist. The most I'll accept is "1520 search results screened out by your security profile".
People don't hold up well having to make the same decision day after day, week after week. Even if you succeed by force of will it's costing you a mental resource that could have be used instead to, for example, negotiate a better mortgage on your house or serve fewer years in prison.
Do You Suffer From Decision Fatigue?
My inability to define half the applications at the Crap Store by rote as candy-coated virii is a travesty of actualized self-determination.
Such permissions are much too broad! An app should be limited to a specific directory be the default, if it needs to have file access at all. For many just being able to save and store their own configuration status is completely sufficient.
Many many apps want far too many permissions. But if you firewall the app it doesn't really matter what it knows, it won't be talking to the Internet.
What I'd really like to see in Android is apps running in a sandbox and you being able to deny specific permissions for any app (with the caveat that may break the app, but so be it.)
With iOS all the permissions and spying is behind the scenes so as not to confuse or concern the user.
This is complete nonsense. It does not mean "many apps are spying on users." It means those apps have permissions which could let them spy on users if they wanted to. In other news, 100% of Windows apps have the ability to spy on users, because Windows doesn't have a fine grained permissions model like Android does. Does that mean 100% of Windows apps "are spying on users?" No, and it doesn't mean Android apps are either.
"I'm too busy to research this and form an educated opinion, but I do have time to tell everyone my uninformed opinion."
Some apps, like dialer apps, do need access to your contacts so they can display them to you.
Coder's Stone: The programming language quick ref for iPad
99% of windows programs have almost full control of and access to almost all data on your computer. Why are people not concerned with that? I think just the fact that Android has such a permissions model is what causes more paranoia.
Ideally an application's description would contain something like a privacy policy that describes what it does with each permission.
Because you should just trust what the ap says?
Do you trust the privacy policy of a web site? Do you trust that an online shopping site won't hand your credit card number to people who would abuse your identity?
Why would a developer lie after all.
To avoid being investigated, tried, and convicted of fraud.
Secure won't get used unless secure is easy.
It is just a matter of interfacing.
Exactly. Until someone comes out with a user interface to build those ACLs that a proverbial grandma could use, those ACLs won't get used. But don't look to Microsoft to make a tool for securing desktop applications any time soon, as Microsoft has been busy monopolizing the distribution of WinRT applications.
If you ignore for a moment that Android was bought over by Google whose raison d'etre is advertising, it's ironic that adware has become so acceptable on Android when it's synonymous with spyware on Windows and is flagged as such by decent antivirus programs.
Most of the ad supported Android apps ask for internet access in order to display ads. The problem is you have no idea what else they're doing with that internet access. I would be very leery of something like a task manager that's ad supported..something with sufficient privileges to kill processes and yet be able to do who knows what with its internet permission.
Rooting and installing an adblocking hosts file, (or using AdAway which automates the process) is one solution, but then it deprives the app devleoper of ad revenue (for something that's otherwise free).
Seems like Google ought to separate the permission for displaying ads from that for internet access - so if your app wants to show ads, it should only be allowed to connect to Google's ad servers and do nothing else. At least that way one has peace of mind that one's ad supported contact list manager isn't surreptitiously transmitting one's phonebook somewhere.
"..One hosts to look them up, one DNS to find them, and in the darkness BIND them."
Why does Dropbox android app need permission to read and write to the phone account list AND CHANGE THE ACCOUNT PASSWORD????
I am well within the specifications of the core slashdot community and my response to you is: fuck you, and fuck off.
I have an android phone. Yes, I know I can root it and get the functions that I expect from this type of device.
No, I don't hack my phone, or my car, or my fridge and I don't want to. I spent my day knee deep in he PC and server and frankly I just want my phone to WORK.
More importantly, if there is even a 1 in 100 chance that this $500 device I have on a 2 year contract is going to be bricked then I am not going to risk it.
When it is out of contract and I have a new phone? sure. but guess what, what do I do it my new phone doesn't have this required functionality and your response is the same?
Fuck you.
If this is not fixed by the time I get a new phone then it is highly like I will buy an iphone. Yes. For app permissions control over everything else.
Which really sucks. Not blaming droidwall here.
Do you trust the privacy policy of a web site?
Of course not.
If you do not trust the privacy policy of any web site, then when you provided your e-mail address to Slashdot when creating the "nedlohs" account, what made you think Slashdot wasn't going to sell your e-mail address to spammers?
And why I buy things from sites that haven't done such things in the past over new sites if the prices aren't too much higher.
What criteria would you use to determine the trustworthiness of a relatively new web site if a product that you want is available for sale only from that site, such as directly from the manufacturer?