4 ms·

Just a random thought: would feeding dummy data solve the issue? E.g. an app requests contacts, OS returns seemingly-innocent randomly generated contact informa

by kaoD 11y ago

Just a random thought: would feeding dummy data solve the issue? E.g. an app requests contacts, OS returns seemingly-innocent randomly generated contact information. Or app requests to send an SMS, the OS informs the app the SMS was sent, but it wasn't. Is there any permission where dummy data would still be easily detected or produce inconvenient (for the user, not the developer) results?

pmalynin 11y ago
Internet access over SSL with key pinning, any attempt to feed dummy data can be easily detected.
chipperyman573 11y ago
There's XPrivacy if your android is rooted, you can chose to deny, allow or fake. http://forum.xda-developers.com/xposed/modules/xprivacy-t2320783 http://forum.xda-developers.com/xposed/modules/xprivacy-t232...
mikeash 11y ago
It would be better for the user if the app cooperated. For example, if you disable microphone access, it's better if the app says you can't make voice calls, rather than attempting them and failing strangely. You could also end up in an arms race if fake data became widespread. Bad apps will try to detect the fake data and insist that you actually enable the relevant permission. It might not be easily detected but I'm sure it would be detectible somehow. Much better would be to shut down apps that act badly when refused inessential permissions. Of course, that's kind of hard, so faking it probably has a useful role to play.
JoshTriplett 11y ago
No need to return randomly-generated contacts; just hand the app an empty contact database. Likewise, tell the app that you just don't have a location fix. For requesting to send an SMS, tell the app that there was a failure to send the SMS (for reasons unrelated to permissions). Act as though you have no signal.
- wlesieutre 11y ago
  I wouldn't be surprised to see apps choke up and crash with an empty contacts database. It goes to inspect your contacts, tries to read the first one alphabetically, and fails to handle "There is no first contact." It shouldn't happen, but you could say the same about any untested edge-case bug.
  - cmdrfred 11y ago
    I concur, maybe give the user an option?

by kaoD 11y ago

pmalynin 11y ago

Internet access over SSL with key pinning, any attempt to feed dummy data can be easily detected.

chipperyman573 11y ago

There's XPrivacy if your android is rooted, you can chose to deny, allow or fake. http://forum.xda-developers.com/xposed/modules/xprivacy-t2320783 http://forum.xda-developers.com/xposed/modules/xprivacy-t232...

mikeash 11y ago

It would be better for the user if the app cooperated. For example, if you disable microphone access, it's better if the app says you can't make voice calls, rather than attempting them and failing strangely. You could also end up in an arms race if fake data became widespread. Bad apps will try to detect the fake data and insist that you actually enable the relevant permission. It might not be easily detected but I'm sure it would be detectible somehow. Much better would be to shut down apps that act badly when refused inessential permissions. Of course, that's kind of hard, so faking it probably has a useful role to play.

JoshTriplett 11y ago

No need to return randomly-generated contacts; just hand the app an empty contact database. Likewise, tell the app that you just don't have a location fix. For requesting to send an SMS, tell the app that there was a failure to send the SMS (for reasons unrelated to permissions). Act as though you have no signal.

wlesieutre 11y ago
I wouldn't be surprised to see apps choke up and crash with an empty contacts database. It goes to inspect your contacts, tries to read the first one alphabetically, and fails to handle "There is no first contact." It shouldn't happen, but you could say the same about any untested edge-case bug.
- cmdrfred 11y ago
  I concur, maybe give the user an option?