8 ms·

Uber app can secretly record your iPhone screen thanks to special ‘entitlement’

87 points by chmars 9y ago

roel_v 9y ago
On a similar topic, how does the facebook app on android suggest me pictures taken with the camera on the phone, when neither it nor any of the facebook infrastructure apps have any permissions on accessing local media?
- superfrank 9y ago
  What version of the app and Android are you running? I'm on Android 8.0 and just double checked, the second I turn off the storage permission, Facebook can no longer suggest or access any images on my device.
  - roel_v 9y ago
    Oops I'm a dumbass scaremongerer it seems - indeed I did have 'storage' still checked despite thinking I had everything disabled! Sorry!
- Cthulhu_ 9y ago
  If you've ever shared a photo via Facebook, the app has that permission, I'm sure. Recheck your permissions settings.
- briandear 9y ago
  On top of that the installed Facebook app spies on your usage of other apps. They bought Onavo for that specific function.
  - spacehunt 9y ago
    If you're talking about the VPN, you have to explicitly turn it on, and the first time you do so Android asks you for permission to let it "monitor network traffic" (actual quote from the dialog).
omarforgotpwd 9y ago
According to the update at the end of the article, Uber says they only used this API to render maps in an early version of their Apple watch app and they haven't been using it at all for some time. They claim they are working with Apple to get this entitlement removed.
- Tepix 9y ago
  Uber also say they protect your privacy, even when they violate it instead.
  - KGIII 9y ago
    I kind of want to know why Apple granted them permission to do this. It seems like a horrible idea, regardless of the app vendor. What the hell were they thinking?
    - Matt3o12_ 9y ago
      They needed to boost the Apple Watch adoption when it was released. To do that, they wanted many apps on there, including popular ones like Uber (and Uber is actually a good use case). Unfortunately, WatchOS couldn’t render maps back then. The marketing department was probably at their ass to get it working, so the engineering team had to come up with something so Uber would be on the Apple Watch: they allowed them to use private APIs. A very bad move but I can understand the motive
      - KGIII 9y ago
        Hmm... I suppose that does explain the motive, though I'm not sure about the logic. On the other hand, I have the luxury of Monday quarterbacking and the knowledge of what has gone on between now and then. I am curious as to who else might have gotten that entitlement and we just don't know it yet. Apple, being more privacy aware (or at least PR aware), probably has not handed it out to bunches of people and governments. Probably...
Tepix 9y ago
For the first time I tried to install the Uber app last weekend when I needed a taxi in a country where Uber is present. I then found out that the Uber iOS app is larger than 150MB (!). I couldn't come up with a reason why the App would need to be that ridiculously huge except for spying frameworks so I did not download it. There were taxis waiting less than 30m away anyway. I'm glad I have not sold my soul to Uber ;-)
- piva00 9y ago
  Spying frameworks wouldn't be responsible for taking so much space, usually the largest files in mobile apps are the assets (sounds, videos, images, etc.) and not code, code is actually quite minimal. So yup, your assumption is probably very wrong. And I'm not an Uber user (exactly for privacy and ethical reasons).
  - chrisper 9y ago
    Don't iOS apps also have all resources embedded regardless of the device? Like high res retina icons are in the app even though you are using an iPhone 4 or whatever. That would also explain the larger app size.
    - Sephiroth87 9y ago
      Not since iOS9...
origami777 9y ago
I just uninstalled it. I do too many confidential things on my phone to even let this be a possibility. That's too bad because I was an avid Uber user. I hope they can shed some light on this and say it's fixed (and verified).
- redka 9y ago
  I guess you can still use m.uber.com
  - origami777 9y ago
    Thanks for sharing that. I wasn’t aware
rovek 9y ago
Interesting that this is being framed as an Uber transgression when Apple should take the rap for even creating this permission in the first place.
- marindez 9y ago
  It's trendy to bash Uber.
- raverbashing 9y ago
  I'd say the permission is valid (seems to be direct fb access or something similar), but should be allowed only in very specific cases
  - blub 9y ago
    And only if a blue/red status bar is shown while this API is in use, and e.g. 5 seconds afterwards. Still, Uber could detect when your phone is on the table and quickly take screenshots. This is very prone to abuse, some log should be available for auditing.
  - jaclaz 9y ago
    >I'd say the permission is valid (seems to be direct fb access or something similar), but should be allowed only in very specific cases Maybe, but then the user should explictly authorize it AND it should be optional, if this is not the case, then it should not exist. In any case, it does sound a bit shady that such permission exists at all and - according to the article - Apple "can decide" who can use it. It seems like there are "class A" and "class B" developers rated by Apple and given (or denied) this "permission".
- phire 9y ago
  Sounds like apple created it as a hack and granted the permission to Uber as a workaround to get Uber's watch app out of the door. Chances are they granted it to other apps to. Then apple forgot to remove the premission after it was obsolete. (Either apple created an alternative method that had no security issues, or Uber had more time to create a implementation that rendered the map on the watch.)
benevol 9y ago
Apple letting a (morally corrupt) third party violate your privacy. And some people still think the government/NSA does somehow not have complete access to your data?
Asdfbla 9y ago
Stuff like that is a bit at odds with the pro-privacy marketing that Apple has been pushing recently. Guess it shows how important certain high-profile apps are for smartphone ecosystems when Uber even got Apple to give them access to features like that.
merricksb 9y ago
Earlier discussion: https://news.ycombinator.com/item?id=15411533 https://news.ycombinator.com/item?id=15411533

87 points by chmars 9y ago

On a similar topic, how does the facebook app on android suggest me pictures taken with the camera on the phone, when neither it nor any of the facebook infrastructure apps have any permissions on accessing local media?

superfrank 9y ago
What version of the app and Android are you running? I'm on Android 8.0 and just double checked, the second I turn off the storage permission, Facebook can no longer suggest or access any images on my device.
- roel_v 9y ago
  Oops I'm a dumbass scaremongerer it seems - indeed I did have 'storage' still checked despite thinking I had everything disabled! Sorry!
Cthulhu_ 9y ago
If you've ever shared a photo via Facebook, the app has that permission, I'm sure. Recheck your permissions settings.
briandear 9y ago
On top of that the installed Facebook app spies on your usage of other apps. They bought Onavo for that specific function.
- spacehunt 9y ago
  If you're talking about the VPN, you have to explicitly turn it on, and the first time you do so Android asks you for permission to let it "monitor network traffic" (actual quote from the dialog).

omarforgotpwd 9y ago

According to the update at the end of the article, Uber says they only used this API to render maps in an early version of their Apple watch app and they haven't been using it at all for some time. They claim they are working with Apple to get this entitlement removed.

Tepix 9y ago
Uber also say they protect your privacy, even when they violate it instead.
- KGIII 9y ago
  I kind of want to know why Apple granted them permission to do this. It seems like a horrible idea, regardless of the app vendor. What the hell were they thinking?
  - Matt3o12_ 9y ago
    They needed to boost the Apple Watch adoption when it was released. To do that, they wanted many apps on there, including popular ones like Uber (and Uber is actually a good use case). Unfortunately, WatchOS couldn’t render maps back then. The marketing department was probably at their ass to get it working, so the engineering team had to come up with something so Uber would be on the Apple Watch: they allowed them to use private APIs. A very bad move but I can understand the motive
    - KGIII 9y ago
      Hmm... I suppose that does explain the motive, though I'm not sure about the logic. On the other hand, I have the luxury of Monday quarterbacking and the knowledge of what has gone on between now and then. I am curious as to who else might have gotten that entitlement and we just don't know it yet. Apple, being more privacy aware (or at least PR aware), probably has not handed it out to bunches of people and governments. Probably...

Tepix 9y ago

For the first time I tried to install the Uber app last weekend when I needed a taxi in a country where Uber is present. I then found out that the Uber iOS app is larger than 150MB (!). I couldn't come up with a reason why the App would need to be that ridiculously huge except for spying frameworks so I did not download it. There were taxis waiting less than 30m away anyway. I'm glad I have not sold my soul to Uber ;-)

piva00 9y ago
Spying frameworks wouldn't be responsible for taking so much space, usually the largest files in mobile apps are the assets (sounds, videos, images, etc.) and not code, code is actually quite minimal. So yup, your assumption is probably very wrong. And I'm not an Uber user (exactly for privacy and ethical reasons).
- chrisper 9y ago
  Don't iOS apps also have all resources embedded regardless of the device? Like high res retina icons are in the app even though you are using an iPhone 4 or whatever. That would also explain the larger app size.
  - Sephiroth87 9y ago
    Not since iOS9...

origami777 9y ago

I just uninstalled it. I do too many confidential things on my phone to even let this be a possibility. That's too bad because I was an avid Uber user. I hope they can shed some light on this and say it's fixed (and verified).

redka 9y ago
I guess you can still use m.uber.com
- origami777 9y ago
  Thanks for sharing that. I wasn’t aware

rovek 9y ago

Interesting that this is being framed as an Uber transgression when Apple should take the rap for even creating this permission in the first place.

marindez 9y ago
It's trendy to bash Uber.
raverbashing 9y ago
I'd say the permission is valid (seems to be direct fb access or something similar), but should be allowed only in very specific cases
- blub 9y ago
  And only if a blue/red status bar is shown while this API is in use, and e.g. 5 seconds afterwards. Still, Uber could detect when your phone is on the table and quickly take screenshots. This is very prone to abuse, some log should be available for auditing.
- jaclaz 9y ago
  >I'd say the permission is valid (seems to be direct fb access or something similar), but should be allowed only in very specific cases Maybe, but then the user should explictly authorize it AND it should be optional, if this is not the case, then it should not exist. In any case, it does sound a bit shady that such permission exists at all and - according to the article - Apple "can decide" who can use it. It seems like there are "class A" and "class B" developers rated by Apple and given (or denied) this "permission".
phire 9y ago
Sounds like apple created it as a hack and granted the permission to Uber as a workaround to get Uber's watch app out of the door. Chances are they granted it to other apps to. Then apple forgot to remove the premission after it was obsolete. (Either apple created an alternative method that had no security issues, or Uber had more time to create a implementation that rendered the map on the watch.)

benevol 9y ago

Apple letting a (morally corrupt) third party violate your privacy. And some people still think the government/NSA does somehow not have complete access to your data?

Asdfbla 9y ago

Stuff like that is a bit at odds with the pro-privacy marketing that Apple has been pushing recently. Guess it shows how important certain high-profile apps are for smartphone ecosystems when Uber even got Apple to give them access to features like that.

merricksb 9y ago

Earlier discussion: https://news.ycombinator.com/item?id=15411533 https://news.ycombinator.com/item?id=15411533