Slashdot Mirror
Study Finds iOS Apps Just As Intrusive As Android Apps
wiredmikey writes "Despite fevered arguments that iOS is more secure than Android, and that Android offers developers more options than iOS, a study has found that both platforms are equally as invasive and curious when it comes to collecting user data. Security firm BitDefender analyzed more than 522,000 apps over the past year and focused on the 'intrusive behaviors' the app developer may have included in the product, such as tracking location, reading contact lists, and leaking your email address or device ID. According to Catalin Cosi, iOS applications appear to be more focused on harvesting private data than the ones designed for Android. Cosi did acknowledge that Android apps state all the permissions needed at installation time and there is no way to change the settings afterwards, while iOS permissions are requested at run-time, as the specific resource is used, making iOS a little bit more secure in practice."
they don't have to ask for permission.
So, what we would need is a change in how permission refusal is communicated (or not communicated) to the app. The OS should always tell the app "yes you got permission", but then just fake the action (return plausible but fake location data, plausible but fake adresses, etc.). Or fail with a code not linked to permission (pretend that there is no cellular network available if user refused permission to use it)
That way, it will be much more difficult to pressure users into granting apps each and every right they ask for...
I like Ubuntu and Debian. They have "app stores" (apt-get install freeciv), and they work well. (I don't use the Ubuntu software center, mainly 'cause I don't want to see ads.) And, the stuff I can install from the main repositories is trustworthy. It's Free Software, and the source is available if I want to look at it. I also trust the organizations behind Debian and Ubuntu to pull software that is found to be unworthy of trust.
But, Apple? Google? I don't trust them. Not only don't I trust them, I don't trust their app stores. I don't trust the software in them. There isn't sufficient review to prevent malicious software getting in. Not only that, the software isn't Free, and so even if I want to look at the code, I can't.
And studies like this show that my lack of trust is probably a good thing. Because the software available is potentially malicious and intrusive (and I get to define what is malicious for me, and invading my privacy is malicious).
HELP MY ACCOUNT HAS BEEN HACKED BY AN ILLIBERAL ART STUDENT SET TO DESTROY THE INTERWEBZ!
If you don't give permission, a good app will pop up a message explaining why it wanted to use that feature, while a bad one will usually just die or act upon null data (e.g. show your contacts as empty).
FWIW I find that I only give apps permissions they actually need with the runtime system. If I never use a feature in an app, it never gets permission to use it, so I know exactly what it can access from the moment I install it. If it makes an unreasonable request, it's rejected and I get on with what I actually want the app to do. Facebook can see my photos because I use it to post photos, but it doesn't know about my location or my contacts.
No kidding!!! What do you say at this point?
But you have to be rooted.
After it became illegal to root a device, Google store remove anything that interfered
with another programs ability to do what it does, firewalls, adblockers, HOSTS files, permission changers...
From the AdAway site:
AdAway is not available on Google Play! It was removed by Google due to Violation of section 4.4 of the Developer Distribution Agreement.
Please install it from F-Droid. https://code.google.com/p/ad-away/
My XOOM tablet is rooted (jailbroken / mine) I have the old "permissions" from Google play
that does change permissions of a program, as well as having a firewall and a HOSTS file installed.
Can't vouch for it as it's a very quick search but http://code.google.com/p/android-permissions/ claims to be able to do this as well.
To see what information an Android program can send, goto www.Rovio.com and read the Tos and Privacy Policy
it's a fav site of mine showing what's collected. Rovio.com is Angry Birds for one, ASTRO file manager reads
the same way both very popular programs.
I've never understood why, when you get an Android app update and the permissions are changed, it goes ahead and lists ALL the app's permissions again rather than just the new ones. And they are so vague as well, like "access to the network" or something. In practice, I just ignore the permission requirements, rendering the system totally worthless.
== Jez ==
Do you miss Firefox? Try Pale Moon.
Can you do this with Android? I can't seem to find a way. It looks like I have to accept everything or nothing. Maybe I'm just not trained.
Memory is deceptive because it is colored by today's events. - Albert Einstein
Cannot. Unless you root it and install 3rd party stuff.
No idea why Android users think the ability to revoke a permission is not important.
Anyone who believed at any point that this was not the case is a fool.
In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
No, but you can see before you install what permissions it is going to need.
Help I am stuck in a signature factory!
I want two bits of functionality. One is the ability to turn off fine grained access to my phone. With mac there is a great program Little Snitch. I can install an application and tell it that it can access the internet except I don't want it phoning home to stats.application.com. Or I can say no net access at all. I want the same thing for all my applications. Generally if the application (say a game) doesn't need net access I would like to cut it off. But at the same time some applications need some net access to be useful but I don't want them calling anyone I don't trust.
Then there are bits that I really don't want applications accessing such as my contacts, messages, photos, etc. And lastly there are bits that I don't want some applications wasting energy with such as a colorwheel application accessing my GPS.
The key functionality is that I don't want an application to be able to not run when I cut it off from non core functionality. It is obvious that my video camera app should give up if I cut off from the camera but it shouldn't be approved if it won't run without net access or GPS. This access restriction would also apply to applications built into the phone itself. No exceptions for google or apple.
A great example of this would be the large number of Facebook logins that want access to my friends. I can't turn that off so I don't use them. I know the second that I say yes they will spam all my friends.
But I am fairly sure that I can hold my breath before either Apple or Google allow this because it would cut off access to the sleazier aspects of both companies.
So am I pirating when I scoot out of range of the WLAN signal?
For one thing, Dice is headquartered in the United States. For another, most people born in the United States lack an opportunity to choose a country other than the United States.
One general problem with app stores that carry only free software is that not everything can be free. Repositories like F-Droid and Ubuntu main/universe don't have players for rented videos because the movie studios require compliance and robustness rules that are fundamentally incompatible with free software licensing. And their selection of things like video games is anemic because creating games requires a lot of skills other than programming for which there isn't much of a counterpart to the free software movement. Without video games, users end up driven to consoles, whose policies tend to be even worse for free software.
No idea why Android users think the ability to revoke a permission is not important.
Really? You pretty much call it right there - they're users, not devs, so their knowledge of the technology is limited. Nobody's told them why it's important, so they don't know or care.
Which is completely understandable, and not a reason to be jerks to them or treat them like idiots (not saying that's what you've done, but you have to admit it's a common behavior among the technologically experienced). After all, no one expects you to be an expert on hydraulics and internal combustion just because you use a car, do they?
An enigma, wrapped in a riddle, shrouded in bacon and cheese
It's amusing to me that for the longest time, Apple fanbois mocked Android users for having the permissions list which "nobody reads anyway," while having *no* information or control over what iOS apps used.
Apple finally gets something that is clearly superior to what Android has out-of-the-box (though it would still be nice to know an app's permissions list before downloading) and suddenly they have no idea why Android doesn't also do it this way. In another 6-12 months when this feature is rolled into stock Android, the Apple fanbois will then claim that Google stole the idea and that iOS has *always* had better handling of app permissions (while also ignoring the fact that this feature has been available for years to pretty much any Android user who wanted it enough to get it).
--Jeremy
Jesus was a liberal
Man. What a way to twist what I wrote around. You do realize that it my stance, right? Read what AC said.
Apple did this as a result of Path and the various state AGs telling them they need to do a better job. So Apple came up with a pretty damned decent way of doing it.
The same issues and state AGs were involved with Android too. Since Android already had a model to start with, why didn't they improve on it, instead of sitting on their ass for so damned long?
*THAT* is the question.
You do realize that it my stance, right?
What your stance? Mongo not understand poorly formatted sentence structure.
Lol, sorry, can't help but bust your balls.
Read what AC said.
Did - your response doesn't seem to have anything to do with their comment. Are you sure you didn't mean the parent (DKlineburg's) post? Or can you expound a bit and give some context?
An enigma, wrapped in a riddle, shrouded in bacon and cheese