4 ms·

You picked a bad example, as Uber car ordering does work with location services disabled. Any better examples come to mind of apps that refuse to run unless he

You picked a bad example, as Uber car ordering does work with location services disabled. Any better examples come to mind of apps that refuse to run unless hey have an unreasonable feature granted?

dmerrick 10y ago
Perhaps this has changed recently, but the last time I tried to use Uber without "allow location access even when not using the app," I was unable to call a ride. Instead, I was given instructions on how to enable that setting.
- djrogers 10y ago
  I've used it constantly without location services since the day they first requested the feature. When I open it, the splash screen has 2 options - Enable Location Services and Enter Pickup Address. Perhaps you missed the second option?
tonyztan 10y ago
On Android, GM's Maven car-sharing app (similar to ZipCar) does not run unless all permissions are granted, which include the ability to manage phone calls. The Chinese WeChat messenger also refuses to run unless location access is granted, even though messaging apps do not depend on location to work. This type of behavior makes fine-grained permissions systems not very useful. It should be prohibited by the Apple App Store and Google Play Store.
- djrogers 10y ago
  Agreed - I don't think this type of thing should be allowed. I'd be very happy if Apple required all apps that use locations services to offer the 'when app is running' option - seems perfectly reasonable to me.
bigiain 10y ago
Signal won't run without access to your contacts (at least on iOS). Whether that's considered "unreasonable" is being actively argued on Twitter at the moment...
- ericlewis 10y ago
  I dont often join in, but the fact this doesn't work without contacts seems alarming. Any guess as to why?
  - sbierwagen 10y ago
    https://www.jwz.org/blog/2017/03/signal-leaks-your-phone-number-to-everyone-in-your-contacts/ https://www.jwz.org/blog/2017/03/signal-leaks-your-phone-num...
    - ufo 10y ago
      Be careful about jwz links on HN. He detects the referrer and redirects to a prank image.
      - sbierwagen 10y ago
        Whoops. And it's too late now to edit the link to point at a referrer-stripper, too.
        bigiain 10y ago
        Yeah - but if you're interested/curious, copy-paste the link into your browser. Moxie weighs in in the comments on jwz's blog there. The "interesting" bit (to me) of Moxie's explanation of what happens is that Signal sends "truncated sha256 hashes" to the Signal servers so it can compute the intersection of all the numbers it scrapes from your contact list with everyone elses. Seems to me there's just not enough entropy in phone numbers to make that nation-state secure. If Moxie gets served a warrant (and a NSL) it wont take _too_ much effort to reverse out all those truncated SHA intersections into a social graph... But then Moxie's POV seems to be "those people would get that same info from your telco records if you use SMS, and at least that's the _only_ metadata we leak, your telco probaby hands that over without a warrant along with at least the date/time of every SMS you've ever sent or received and quite probaby the contents as well... I lean a lot towards jwz's argument that they're _way_ overselling the privacy-preserving nature of Signal. Especially if one of your adversaries is someone who knows your mobile number and would benefit from knowing you choose to use encrypted communication (like, say, everybody in the UK right now...)

You picked a bad example, as Uber car ordering does work with location services disabled. Any better examples come to mind of apps that refuse to run unless hey have an unreasonable feature granted?

dmerrick 10y ago

Perhaps this has changed recently, but the last time I tried to use Uber without "allow location access even when not using the app," I was unable to call a ride. Instead, I was given instructions on how to enable that setting.

djrogers 10y ago
I've used it constantly without location services since the day they first requested the feature. When I open it, the splash screen has 2 options - Enable Location Services and Enter Pickup Address. Perhaps you missed the second option?

tonyztan 10y ago

On Android, GM's Maven car-sharing app (similar to ZipCar) does not run unless all permissions are granted, which include the ability to manage phone calls. The Chinese WeChat messenger also refuses to run unless location access is granted, even though messaging apps do not depend on location to work. This type of behavior makes fine-grained permissions systems not very useful. It should be prohibited by the Apple App Store and Google Play Store.

djrogers 10y ago
Agreed - I don't think this type of thing should be allowed. I'd be very happy if Apple required all apps that use locations services to offer the 'when app is running' option - seems perfectly reasonable to me.

bigiain 10y ago

Signal won't run without access to your contacts (at least on iOS). Whether that's considered "unreasonable" is being actively argued on Twitter at the moment...

ericlewis 10y ago
I dont often join in, but the fact this doesn't work without contacts seems alarming. Any guess as to why?
- sbierwagen 10y ago
  https://www.jwz.org/blog/2017/03/signal-leaks-your-phone-number-to-everyone-in-your-contacts/ https://www.jwz.org/blog/2017/03/signal-leaks-your-phone-num...
  - ufo 10y ago
    Be careful about jwz links on HN. He detects the referrer and redirects to a prank image.
    - sbierwagen 10y ago
      Whoops. And it's too late now to edit the link to point at a referrer-stripper, too.
      - bigiain 10y ago
        Yeah - but if you're interested/curious, copy-paste the link into your browser. Moxie weighs in in the comments on jwz's blog there. The "interesting" bit (to me) of Moxie's explanation of what happens is that Signal sends "truncated sha256 hashes" to the Signal servers so it can compute the intersection of all the numbers it scrapes from your contact list with everyone elses. Seems to me there's just not enough entropy in phone numbers to make that nation-state secure. If Moxie gets served a warrant (and a NSL) it wont take _too_ much effort to reverse out all those truncated SHA intersections into a social graph... But then Moxie's POV seems to be "those people would get that same info from your telco records if you use SMS, and at least that's the _only_ metadata we leak, your telco probaby hands that over without a warrant along with at least the date/time of every SMS you've ever sent or received and quite probaby the contents as well... I lean a lot towards jwz's argument that they're _way_ overselling the privacy-preserving nature of Signal. Especially if one of your adversaries is someone who knows your mobile number and would benefit from knowing you choose to use encrypted communication (like, say, everybody in the UK right now...)