Slashdot Mirror
Study Finds iOS Apps Just As Intrusive As Android Apps
wiredmikey writes "Despite fevered arguments that iOS is more secure than Android, and that Android offers developers more options than iOS, a study has found that both platforms are equally as invasive and curious when it comes to collecting user data. Security firm BitDefender analyzed more than 522,000 apps over the past year and focused on the 'intrusive behaviors' the app developer may have included in the product, such as tracking location, reading contact lists, and leaking your email address or device ID. According to Catalin Cosi, iOS applications appear to be more focused on harvesting private data than the ones designed for Android. Cosi did acknowledge that Android apps state all the permissions needed at installation time and there is no way to change the settings afterwards, while iOS permissions are requested at run-time, as the specific resource is used, making iOS a little bit more secure in practice."
they don't have to ask for permission.
I believe that iOS apps are generally more secure for various reasons, but not for the one mentioned in the article. When the user installs an app he will be looking at the requested permissions and have a bit time to think about them (at least that's what I do) and you can see all at once. When people are asked at runtime while actually using the app, they will just grant the permission. (BTW, what happens if the permission is not given at RT? The app just quits?)
So, what we would need is a change in how permission refusal is communicated (or not communicated) to the app. The OS should always tell the app "yes you got permission", but then just fake the action (return plausible but fake location data, plausible but fake adresses, etc.). Or fail with a code not linked to permission (pretend that there is no cellular network available if user refused permission to use it)
That way, it will be much more difficult to pressure users into granting apps each and every right they ask for...
I like Ubuntu and Debian. They have "app stores" (apt-get install freeciv), and they work well. (I don't use the Ubuntu software center, mainly 'cause I don't want to see ads.) And, the stuff I can install from the main repositories is trustworthy. It's Free Software, and the source is available if I want to look at it. I also trust the organizations behind Debian and Ubuntu to pull software that is found to be unworthy of trust.
But, Apple? Google? I don't trust them. Not only don't I trust them, I don't trust their app stores. I don't trust the software in them. There isn't sufficient review to prevent malicious software getting in. Not only that, the software isn't Free, and so even if I want to look at the code, I can't.
And studies like this show that my lack of trust is probably a good thing. Because the software available is potentially malicious and intrusive (and I get to define what is malicious for me, and invading my privacy is malicious).
HELP MY ACCOUNT HAS BEEN HACKED BY AN ILLIBERAL ART STUDENT SET TO DESTROY THE INTERWEBZ!
Intrusive, fevered, invasive, curious, leaking, harvesting... Wow... That post was like a "post"er child for FUD.
But you have to be rooted.
After it became illegal to root a device, Google store remove anything that interfered
with another programs ability to do what it does, firewalls, adblockers, HOSTS files, permission changers...
From the AdAway site:
AdAway is not available on Google Play! It was removed by Google due to Violation of section 4.4 of the Developer Distribution Agreement.
Please install it from F-Droid. https://code.google.com/p/ad-away/
My XOOM tablet is rooted (jailbroken / mine) I have the old "permissions" from Google play
that does change permissions of a program, as well as having a firewall and a HOSTS file installed.
Can't vouch for it as it's a very quick search but http://code.google.com/p/android-permissions/ claims to be able to do this as well.
To see what information an Android program can send, goto www.Rovio.com and read the Tos and Privacy Policy
it's a fav site of mine showing what's collected. Rovio.com is Angry Birds for one, ASTRO file manager reads
the same way both very popular programs.
I've never understood why, when you get an Android app update and the permissions are changed, it goes ahead and lists ALL the app's permissions again rather than just the new ones. And they are so vague as well, like "access to the network" or something. In practice, I just ignore the permission requirements, rendering the system totally worthless.
== Jez ==
Do you miss Firefox? Try Pale Moon.
I'm sure they did a fine job.
Apple devices are more secure for certain threat scenarios. Fore full disk encryption iOS uses a PBKDF and a hsm to generate the key. That means that you can't really brute force the key except on the device. Android uses the pin to generate the key directly, which is much weaker.
That said, I have public key cryptography for email, and textsecure for SMS on the android device I'm typing this with. I wish Google, or just a hardware company would step up their game, because this is where it's needed.
Only the brainwashed believe otherwise.
Anyone who believed at any point that this was not the case is a fool.
In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
I want two bits of functionality. One is the ability to turn off fine grained access to my phone. With mac there is a great program Little Snitch. I can install an application and tell it that it can access the internet except I don't want it phoning home to stats.application.com. Or I can say no net access at all. I want the same thing for all my applications. Generally if the application (say a game) doesn't need net access I would like to cut it off. But at the same time some applications need some net access to be useful but I don't want them calling anyone I don't trust.
Then there are bits that I really don't want applications accessing such as my contacts, messages, photos, etc. And lastly there are bits that I don't want some applications wasting energy with such as a colorwheel application accessing my GPS.
The key functionality is that I don't want an application to be able to not run when I cut it off from non core functionality. It is obvious that my video camera app should give up if I cut off from the camera but it shouldn't be approved if it won't run without net access or GPS. This access restriction would also apply to applications built into the phone itself. No exceptions for google or apple.
A great example of this would be the large number of Facebook logins that want access to my friends. I can't turn that off so I don't use them. I know the second that I say yes they will spam all my friends.
But I am fairly sure that I can hold my breath before either Apple or Google allow this because it would cut off access to the sleazier aspects of both companies.
So am I pirating when I scoot out of range of the WLAN signal?
For one thing, Dice is headquartered in the United States. For another, most people born in the United States lack an opportunity to choose a country other than the United States.
One general problem with app stores that carry only free software is that not everything can be free. Repositories like F-Droid and Ubuntu main/universe don't have players for rented videos because the movie studios require compliance and robustness rules that are fundamentally incompatible with free software licensing. And their selection of things like video games is anemic because creating games requires a lot of skills other than programming for which there isn't much of a counterpart to the free software movement. Without video games, users end up driven to consoles, whose policies tend to be even worse for free software.