Slashdot Mirror
The App That Tracks Who's Tracking You
Daniel_Stuckey writes "It's no secret that apps like maps or local weather know your current location, and you're probably cool with that because you want to use the handy services they provide in exchange. But chances are there are many other apps on your phone, anything from dictionaries to games, that are also geolocating your every move without your knowledge or permission. Now researchers are developing a new app to police these smartphone spies, by tracking which apps are secretly tracking you, and warning you about it.
Before your eyes glaze over at the mention of yet another privacy tool, it's worth noting that this new app is the first to be able to provide this line of defense between snooping apps and smartphone users for Android phones. Android's operating system is engineered not to allow apps to access information about other apps. But a team at Rutgers University found a way around that, by leveraging a function of Android's API to send a signal whenever an app requests location information from the operating system. MIT Technology Review reported on the research today."
Briefly reading TFA, these guys are analyzing people's reactions to various privacy-warning user interface options. Their baby app that heuristically monitors location-api usage is far less capable than xprivacy or its kin of android tools.
Despite Google yanking App Ops out of Kit Kat in the latest update, you can still put it back in.
No need for Angry Birds to have access to your information. Simply limit what it can access and forget it.
There's a way for an app to discover and report on what other apps are doing? FAN-BLOODY-TASTIC! Because THAT'S not a security hole at all!
The actual metadata is collected at, or near, the source, they only download app "fixes" when you're actively being pursued.
So, this will give a false sense of security to the 99.9 percent of American citizens who are being tracked by the NSA in an Unconstitutional and Illegal manner.
Oh, and we know exactly where you are even when you turn off location services, btw.
-- Tigger warning: This post may contain tiggers! --
This is an app that exploits a security hole to detect apps that are exploiting a security hole? What's wrong with this picture?
Google removed App Ops for versions in an update for 4.42. If you don't have a rooted phone, the closest thing I've found to a solution is Mobiwol, a firewall which forces apps to connect to the internet through a VPN that doesn't go anywhere. You can choose to give apps their access to the outside world whenever they have focus, so at least they only spy on you when you're using them. Then the problem is: should you trust Mobiwol?
.. if you go hastefully through the ToS it is very easy to miss that _some_ data will be communicated to 'momma' server _anyway_, regardless of user control settings, and that they reserve the right to do basically whatever they want with it.
Their stated intentions for the collected data, should they (the company behind the addon, working with Mozilla for the time being) not be acquired, go bankrupt or 'experience corporate restructuring', is to produce a public internet map with it to show which megacorp is connected to which other megacorp- but there is no link or even a timeline for that, and they are not really clear as to what data they will make public, how, when and where.
I have my doubts for them, as I do for this app.
The three laws of thermodynamics:(1) You can't win. (2) You can't break even. (3) You can't even quit.
It's trackers all the way down.
Android doesn't already have this? I mean, iOS has been asking about location usage for ages, and has an option to disable location services for individual apps for a while now. (An interesting side effect is that access to stored photos ALSO brings up the location services question as photos may have geotags in them - so apps can't get around it by snapping photos and reading out the geotag information).
And anyhow, you can always turn off location services on Android to keep apps from getting your location information.
OTOH, one has to consider that to Google, Android is really there to prevent Apple from locking Google out of mobile advertising. It's why Google acquired Android and why they made it open-source. Google knows mobiles would be a big part of it (and mobile traffic is roughly 2:1 iOS:Android), and that Apple could easily strangle Google in this field, hence, Android.
So perhaps it's all by design - Google's not wanting to give up mobile advertising. Sure they'll probably toss a bone or two - just enough to hobble mobile advertising competitors, but not Google's own advertising networks...
Google removed the api, but not because it was something they wanted to prevent.
The API was done in a hackish way that could cause more security issues than it solved.
I expect Google will install an after-the-fact fined grained permissions control in a future Android versions, that will allow you to turn off access for apps that are permission greedy. If you prevent access to some information, an installed app may fail, but that is preferable to the blanket installation time approval system we have today.
Sig Battery depleted. Reverting to safe mode.
Sounds like Xzibit pimped your phone...
The app should allow blocking of certain apps access to gps or whatever system they are trying to access. If my dictionary app is accessing my gps then allow me to block that app from using it.
You probably want lying rather than blocking... The arms race between you and the hostile dev is over pretty quickly if you block (plus, naive applications that just assume they have the permissions they requested on install will probably crash right, left, and center, which is their fault; but your problem). Lying, by contrast, is unlikely to be 100% bulletproof against a good data-miner; but 'well-formed and plausible' is certainly much, much, harder to notice and respond to with certainty than being blocked is.
That's been my preferred method since the mid-90's. It also makes fingerprinting the device more difficult if you are jiggling the values between sessions. Now if it were as easy on my Nexus 7s as it's been on the desktop/servers.
"[I]t is a wise man who admits the limits of his knowledge or skill, and that pretending either causes harm." --Terry Go
Or maybe, Android could deny approval of applications that try to seek location data for applications that have no location based function. Data mongering fuckers.
Didn't think there was any approval process in Android. So you install an app, it may tell you that it wants your location data, and if you say "no" it won't work. Your choice of giving up your location or not using the app. Minor case of blackmail. That's where the "walled garden" approach comes handy. If your app needs location data for no good reason then it doesn't get on the store. If it refuses to perform functions that don't need location data, when the user refuses to allow access to location, it doesn't get on the store. In any case, the user will be asked the first time location data is used, and can remove permission at any time in "Settings".
Immediately after reading the summary, I suspected this would just use "getLastKnownLocation" and correlate that with the foreground app. From searching through TFA, that is indeed the case. Technically, not very interesting at all.