3 ms·
Yeah--reading the Ars Technica review of Marshmallow terrified me with some of the things they are doing there. Like the fact that users have more granular con
by shostack 11y ago
Yeah--reading the Ars Technica review of Marshmallow terrified me with some of the things they are doing there. Like the fact that users have more granular control over permissions now, but internet is always on for apps no matter what, there's a whole slew of permissions that aren't exposed through the user-controllable permissions that are pretty bad, and there's new stuff in there that allows screenshots to be sent from an app to Google for "searching in the app." I try to read this stuff without a tinfoil hat, but they sure don't make it easy.
- mike_hearn 11y agoThe internet permission has been semi-broken from Android 1.0 onwards. In particular, people tended to interpret it as "this app cannot upload my data to the internet". But then it was discovered apps could do things like request the music app to play an audio stream from an arbitrary URL. Any data to exfiltrate can be put into the query params. Or the app can request the browser to open, same trick. By the time the user realises what's happened the data is gone already. In fact more or less any app that can be convinced via IPC to open an attacker-controlled URL can be used to circumvent the expected meaning of the internet permission. And then there's the inconvenient fact that virtually all apps need it for one reason or another, so it just became meaningless. Good riddance, I say.
- biafra 11y agoWhat permission are you referring to, that allows apps to send screenshots to Google?
- shostack 11y agoNot sure it is actually a permission so much as a feature of Google Now. Paragraph 2 of this page: http://arstechnica.com/gadgets/2015/10/android-6-0-marshmallow-thoroughly-reviewed/3/ http://arstechnica.com/gadgets/2015/10/android-6-0-marshmall...