6 ms·

"Another change to the Android permission system is that every app automatically gets access to the Internet now, and users have no way of turning this off." g

"Another change to the Android permission system is that every app automatically gets access to the Internet now, and users have no way of turning this off." google still does not get the fact that some apps do not need, and should not be able to transmit or receive data from the network. We still need root and install AFWall+ to secure our phones.

click170 11y ago
Yet another case where gateway firewalls can give you back some of the privacy that these companies attempt to wrench away from you. PfSense is a free gateway firewall but the UI left much to be desired last I checked. Another option is the Sophos UTM, which has a firewall, web filter, and VPN server built into one. Gateway protections are your last resort when it comes to protecting yourself from shady behavior like this.
- dijit 11y ago
  gateways don't help when you're a mobile user. which is why I have little snitch on my mac... I'm not _always_ going to be using my laptop at home- and that's increasingly true for my mobile phone which is almost never left home.
  - ac29 11y ago
    They do if you connect to them via VPN.
  - click170 11y ago
    Always-On VPN. I won't buy a phone that doesn't have that feature.
    - storrgie 11y ago
      You've missed the entire original point. It doesn't matter that you're tunneling traffic through some non-local endpoint, the point is that the traffic shouldn't leave your device by default.
      - gcb0 11y ago
        but you have control on the vpn side. i still have one question in a forum about why Android browser's ignore etc/hosts, and every now and then (question is 6 years old) people comment how shocked they are to discover that is the case (still!)
        tjoff 11y ago
        No you don't. How would you filter traffic based on apps on the vpn side? Or feature? I'd love a firewall rule that could block any traffic that contains my contact list. Wouldn't be possible even if the traffic wasn't encrypted...
        jon-wood 11y ago
        Sure you could - have a contact on your phone called something like 000-alarm and filter any requests containing that string. Its not foolproof, but it certainly isn't impossible. Maybe scatter a few of these contacts through the alphabet to catch apps sending in batches.
        kbenson 11y ago
        That doesn't help if they are encrypting the data before sending it. As responsible developers they wouldn't want to send your entire address book across the wire in the clear, would they? Why, someone could easily listen in and then you would have no privacy! /sarcasm.
        stefanix 11y ago
        Like fixing a boat hull with duct tape. Totally possible if you don't care about water in the boat.
        SturgeonsLaw 11y ago
        > i still have one question in a forum about why Android browser's ignore etc/hosts To make it harder to write an ad blocker
      - 11y ago
- anonbanker 11y ago
  PFsense has an amazing GUI. what problems did you experience?
  - click170 11y ago
    The menu items were not grouped logically, eg in order to change something in one feature I had to browse through every single config page in order to find the related options. It was possible to do, and PFSense Support was phenomenal (by chance the co-founder answered the phone when we called Support), but the UI left much to be desired. Compared to my experiences with the Sophos UTM, it's downright painful. With the UTM the UI elements of every part of a service are grouped together, and are duplicated in sections where it's intuitive to do so. Eg Certificate Management can be found in multiple places in the UTM but all things related to the web filter are in one place, all things related to routing are in one place, et al.
    - tjoff 11y ago
      I wholeheartedly agree. I'm sure the GUI works great for anyone used to it but it really is not logical, I simply can not count the times or frustrations I've had, going through each menu reading each item just to find that darn feature I was after. Luckily they are redesigning the GUI for the next version, I'm hopeful that they will rearrange it as well (even though that will obviously be awkward for everyone already familiar with it) but I don't know, haven't paid attention to the development. Case in point: Reboot, shutdown and Backup/Restore ought to be under the "System" menu, right? Nope. It's under Diagnostics, which is a large alphabetically sorted list (not by functionality or anything else, so if you are unsure of which term was used, well, you're better off consulting google).
      - click170 11y ago
        Thank you for highlighting that they are redesigning the UI. I much prefer to support PFSense because they seem more supportive of their community, I will be looking forward to trying out their new UI when its out!
nocman 11y ago
I'm sorry but in case anyone at Google is listening (not that they'll care what I have to say) -- that is definitively evil.
- suby 11y ago
  It's a good thing they just changed their slogan to "Do the right thing." Much more ambiguous.
  - deleted 11y ago
    [deleted]
  - kllrnohj 11y ago
    No they didn't: https://investor.google.com/corporate/google-code-of-conduct.html https://investor.google.com/corporate/google-code-of-conduct... The first 3 words are still "Don't be evil" You're confused about the news that Alphabet now has a parent Code of Conduct that is "Do the right thing". But Google retains "Don't be evil".
    - suby 11y ago
      Ah, good to know. Sorry about that.
  - yohui 11y ago
    Isn't "Do the right thing" actually more affirmative? I recall that "Don't be evil" was criticized for being passive and morally neutral; Alphabet's new motto addresses that.
    - cpeterso 11y ago
      Though their definition of "Do the right thing" seems like a pretty low bar: I. Avoid Conflicts of Interest II. Ensure Financial Integrity and Responsibility III. Obey the Law https://investor.google.com/corporate/code-of-conduct.html https://investor.google.com/corporate/code-of-conduct.html
esteth 11y ago
So many apps would require internet that users would become desensitized to the permissions box and just say "yes" every time the box comes up without even reading it maybe?
- RyanZAG 11y ago
  That will happen anyway - see iOS where users nearly always accept permissions, or Windows where users just click OK. It's not the frequency or importance of popups. Users simply don't read them. From watching users, the users who don't read them usually have an image in their minds of what they're trying to accomplish and an image of the screens they need to go through to get there. Any popup or notification screen is instantly dismissed so that they can see the screen behind and try work out if it's where they expect to be. It's maybe 25% of users who do this, but they do it constantly regardless of what the popup is.
- klintwood 11y ago
  Allowing Internet permissions by default is one thing, not providing a way for the so inclined to disallow them is another. I think most people would have no problem if this was just a changeable default.
AdmiralAsshat 11y ago
One step forward, two steps back...
simfoo 11y ago
The problem now is, if some app requests access to my contacts, it will not only gain access to them but also the ability to upload them to some shady service. This alone is the reason I will not use Android 6 before they either change this or there is a good firewall available (and I am able to root my device)
- buffoon 11y ago
  Definitely. I wrote a mental note that that when I have to start thinking in this manor and tread carefully in a minefield then the technology does not serve me any more and I don't want it. Time up.
- issaria 11y ago
  The solution is don't install any app that request contract access, at least I won't do that again.
on_and_off 11y ago
>google still does not get the fact that some apps do not need I think that Google is way aware of the situation. The problem is that most apps need internet access in order to work. A permission that most of the apps will have to ask for is useless because the casual user will just be trained to accept it in all cases. AFAIK, that's how iOS handles network access as well. Permissions are here to safeguard the access to your personal data, that's it.

click170 11y ago

Yet another case where gateway firewalls can give you back some of the privacy that these companies attempt to wrench away from you. PfSense is a free gateway firewall but the UI left much to be desired last I checked. Another option is the Sophos UTM, which has a firewall, web filter, and VPN server built into one. Gateway protections are your last resort when it comes to protecting yourself from shady behavior like this.

dijit 11y ago
gateways don't help when you're a mobile user. which is why I have little snitch on my mac... I'm not _always_ going to be using my laptop at home- and that's increasingly true for my mobile phone which is almost never left home.
- ac29 11y ago
  They do if you connect to them via VPN.
- click170 11y ago
  Always-On VPN. I won't buy a phone that doesn't have that feature.
  - storrgie 11y ago
    You've missed the entire original point. It doesn't matter that you're tunneling traffic through some non-local endpoint, the point is that the traffic shouldn't leave your device by default.
    - gcb0 11y ago
      but you have control on the vpn side. i still have one question in a forum about why Android browser's ignore etc/hosts, and every now and then (question is 6 years old) people comment how shocked they are to discover that is the case (still!)
      - tjoff 11y ago
        No you don't. How would you filter traffic based on apps on the vpn side? Or feature? I'd love a firewall rule that could block any traffic that contains my contact list. Wouldn't be possible even if the traffic wasn't encrypted...
        jon-wood 11y ago
        Sure you could - have a contact on your phone called something like 000-alarm and filter any requests containing that string. Its not foolproof, but it certainly isn't impossible. Maybe scatter a few of these contacts through the alphabet to catch apps sending in batches.
        kbenson 11y ago
        That doesn't help if they are encrypting the data before sending it. As responsible developers they wouldn't want to send your entire address book across the wire in the clear, would they? Why, someone could easily listen in and then you would have no privacy! /sarcasm.
        stefanix 11y ago
        Like fixing a boat hull with duct tape. Totally possible if you don't care about water in the boat.
      - SturgeonsLaw 11y ago
        > i still have one question in a forum about why Android browser's ignore etc/hosts To make it harder to write an ad blocker
    - 11y ago
anonbanker 11y ago
PFsense has an amazing GUI. what problems did you experience?
- click170 11y ago
  The menu items were not grouped logically, eg in order to change something in one feature I had to browse through every single config page in order to find the related options. It was possible to do, and PFSense Support was phenomenal (by chance the co-founder answered the phone when we called Support), but the UI left much to be desired. Compared to my experiences with the Sophos UTM, it's downright painful. With the UTM the UI elements of every part of a service are grouped together, and are duplicated in sections where it's intuitive to do so. Eg Certificate Management can be found in multiple places in the UTM but all things related to the web filter are in one place, all things related to routing are in one place, et al.
  - tjoff 11y ago
    I wholeheartedly agree. I'm sure the GUI works great for anyone used to it but it really is not logical, I simply can not count the times or frustrations I've had, going through each menu reading each item just to find that darn feature I was after. Luckily they are redesigning the GUI for the next version, I'm hopeful that they will rearrange it as well (even though that will obviously be awkward for everyone already familiar with it) but I don't know, haven't paid attention to the development. Case in point: Reboot, shutdown and Backup/Restore ought to be under the "System" menu, right? Nope. It's under Diagnostics, which is a large alphabetically sorted list (not by functionality or anything else, so if you are unsure of which term was used, well, you're better off consulting google).
    - click170 11y ago
      Thank you for highlighting that they are redesigning the UI. I much prefer to support PFSense because they seem more supportive of their community, I will be looking forward to trying out their new UI when its out!

nocman 11y ago

I'm sorry but in case anyone at Google is listening (not that they'll care what I have to say) -- that is definitively evil.

suby 11y ago
It's a good thing they just changed their slogan to "Do the right thing." Much more ambiguous.
- deleted 11y ago
  [deleted]
- kllrnohj 11y ago
  No they didn't: https://investor.google.com/corporate/google-code-of-conduct.html https://investor.google.com/corporate/google-code-of-conduct... The first 3 words are still "Don't be evil" You're confused about the news that Alphabet now has a parent Code of Conduct that is "Do the right thing". But Google retains "Don't be evil".
  - suby 11y ago
    Ah, good to know. Sorry about that.
- yohui 11y ago
  Isn't "Do the right thing" actually more affirmative? I recall that "Don't be evil" was criticized for being passive and morally neutral; Alphabet's new motto addresses that.
  - cpeterso 11y ago
    Though their definition of "Do the right thing" seems like a pretty low bar: I. Avoid Conflicts of Interest II. Ensure Financial Integrity and Responsibility III. Obey the Law https://investor.google.com/corporate/code-of-conduct.html https://investor.google.com/corporate/code-of-conduct.html

esteth 11y ago

So many apps would require internet that users would become desensitized to the permissions box and just say "yes" every time the box comes up without even reading it maybe?

RyanZAG 11y ago
That will happen anyway - see iOS where users nearly always accept permissions, or Windows where users just click OK. It's not the frequency or importance of popups. Users simply don't read them. From watching users, the users who don't read them usually have an image in their minds of what they're trying to accomplish and an image of the screens they need to go through to get there. Any popup or notification screen is instantly dismissed so that they can see the screen behind and try work out if it's where they expect to be. It's maybe 25% of users who do this, but they do it constantly regardless of what the popup is.
klintwood 11y ago
Allowing Internet permissions by default is one thing, not providing a way for the so inclined to disallow them is another. I think most people would have no problem if this was just a changeable default.

AdmiralAsshat 11y ago

One step forward, two steps back...

simfoo 11y ago

The problem now is, if some app requests access to my contacts, it will not only gain access to them but also the ability to upload them to some shady service. This alone is the reason I will not use Android 6 before they either change this or there is a good firewall available (and I am able to root my device)

buffoon 11y ago
Definitely. I wrote a mental note that that when I have to start thinking in this manor and tread carefully in a minefield then the technology does not serve me any more and I don't want it. Time up.
issaria 11y ago
The solution is don't install any app that request contract access, at least I won't do that again.

on_and_off 11y ago

>google still does not get the fact that some apps do not need I think that Google is way aware of the situation. The problem is that most apps need internet access in order to work. A permission that most of the apps will have to ask for is useless because the casual user will just be trained to accept it in all cases. AFAIK, that's how iOS handles network access as well. Permissions are here to safeguard the access to your personal data, that's it.