5 ms·

How is this even possible that a 3rd party application can intercept all text messages, call history, and photos and still get published to the Android Play Sto

How is this even possible that a 3rd party application can intercept all text messages, call history, and photos and still get published to the Android Play Store? Ins't Google supposed to be reviewing the apps?

HarryHirsch 9y ago
Isn't Google supposed to be reviewing the apps? The real question is: who gets to say in what someone's phone is going to be doing: the programmer, the manufacturer or the phone's owner. Most everyone would agree that the owner should have a word in it, and that the manufacturer should have no say at all. Germany takes another approach: no one gets to do surveillance outside strict limits, privacy is highly regarded over there. The Guardian reports: https://www.theguardian.com/technology/2017/nov/18/germany-bans-childrens-smart-watches-over-surveillance-concerns https://www.theguardian.com/technology/2017/nov/18/germany-b...
- nodesocket 9y ago
  Unfortunately most phone owners are unaware of technical details, security, and privacy implications. I'd argue Apple has the right approach with their heavy handed reviews and security model.
- greglindahl 9y ago
  A better question is how can we give the owner a say without the typical owner getting pwned roughly 100% of the time? Which is what's happening on Android at the moment.
  - HarryHirsch 9y ago
    Someone invoking "personal responsibility" usually means that they try to drop their responsibilities on someone else, but for car maintenance it actually works. People know they should change tires when they are getting bald and leave brake maintenance to their mechanic unless they really know what they are doing. Anyone who gives a game access to their contacts really had it coming to them. (Disclaimer: don't own a smartphone)
    - greglindahl 9y ago
      I recall that there are regulations about cars that make it more likely that a wide variety of owners will be able to maintain them successfully.
      - mulmen 9y ago
        Really? That's interesting, can you elaborate?
        greglindahl 9y ago
        The US regulates "wear bars" on tires, which make it a lot more obvious when tires need to be replaced. I'm not saying that government regulation is needed, I'm just pointing out that the purpose of this tire feature is to make it more likely that people notice tire wear, and don't die from accidents involving bald tires.
        mulmen 9y ago
        Ah thank you for the clarification. I was thinking along the lines of a right to repair where maintenance tasks such as replacing filters are convenient. I would not attribute that to regulation as much as practicality in even mechanics working on the cars.
        jessaustin 9y ago
        Weren't there some BMWs that required a mechanic with a special tool just to refill the DEF tank?
        greglindahl 9y ago
        Is this getting a bit far afield from trying to balance phone owner responsibility with safety and ownership?
    - spookthesunset 9y ago
- simonh 9y ago
  >Most everyone would agree that the owner should have a word in it, and that the manufacturer should have no say at all. Isn’t setting the defaults behaviour ‘Having a say’, and who else but the manufacturer gets to do that? Sorry but this suggestion doesn’t make it past even 2 seconds of considered thought. Another few seconds - who gets to decide what privacy controls the phone even has, if not the manufacturer? Does this not count as having a say? I can see why some manufacturers would agree with you though, many of them give the impression they don’t want to have any responsibility in this area whatsoever.
  - TheSpiceIsLife 9y ago
    > who gets to decide what privacy controls the phone even has Regulatory bodies and / or standards organisations. Some kind of "This devices meets or exceeds the International Organization for Standardization of mobile device security..." We don't even have a voluntary one of those.
deleted 9y ago
[deleted]
oldcynic 9y ago
Going on their website, it's not in the Android app store. Looks like you buy, download then side load it. There's no iOS version.
magnetic 9y ago
Whenever I would publish my app (or an update) on the Android Play Store, it seemed like it would be available almost immediately, which hints at the absence of review process. Also, I've never had to have a discussion with any "reviewer" about my app on Android. For iOS, I've always had to do quite a few back and forth interactions with the "Resolution Center". Android seems to be a pass through, perhaps after some automated checks are passing. As mentioned by others, you don't necessarily have to publish to the Play Store: apps can be side-loaded on Android.
newscracker 9y ago
This is by design. For the apps on Google Play Store, Google wouldn't look at these because it's been possible to do all these and more using the APIs provided by the Android OS all along, even before the granular runtime permission model came with Android 6 (Marshmallow). I always dread the thought of people not understanding these permissions and letting apps have all kinds of permissions — access to all text messsages, privilege to send text messages, access to call history and privilege to make calls. Many apps read the text messages to process one time passwords/codes sent as text messages, thus avoiding the user having to enter them manually. These privileges have never been available in iOS for third party apps, and I appreciate Apple deciding to err on this side of the privacy equation (though Apple could still do a lot more on app permissions). Taking the same example as above, iOS apps that need one time passwords/codes depend on the user to enter them manually.
- duxup 9y ago
  So many apps ask for permissions that I think most users just hit allow just to get past them. I think they absolutely don't understand them and there's nothing at the moment you're running the app to encourage you to learn.
deleted 9y ago
[deleted]
paul7986 9y ago
Unless that’s changed Google doesn’t review apps like Apple does.
deleted 9y ago
[deleted]
nitrogen 9y ago
As a regular Android user, I'll say that Android's permission model is simply awful. There's no way (in stock) to return blank data, so apps will simply shut down or silently malfunction if you refuse permissions. The grouping of permissions lumps "can portscan your network" and "run hidden in the background when your phone boots" under "Other", which you can't disable. J2ME had a more refined security model back in 2006.
- smoyer 9y ago
  There are so many applications I'd love to install but ... why do they insist on asking for permissions that they simply don't need for their stated functionality. <sarcasm>Of course you want your SSH terminal to have ties to the social networks</sarcasm>.
  - tachyoff 9y ago
    “I just logged into my server! <Share on FB><Tweet this>” Yeah, that’s frustrating. Mobile app permissions are a gross nightmare.
- jessaustin 9y ago
  I agree, but many of the apps I've "crippled" using the following app still work as well as I need them to work: https://play.google.com/store/apps/details?id=com.gmail.heagoo.pmaster.pro https://play.google.com/store/apps/details?id=com.gmail.heag...
- andymal 9y ago
  APK devs should be checking to see if they have been granted permissions instead of crashing. https://developer.android.com/reference/android/support/v4/content/ContextCompat.html#checkSelfPermission(android.content.Context https://developer.android.com/reference/android/support/v4/c..., java.lang.String) If an application won't work after I've turned off all the permissions that it shouldn't need, it simply gets uninstalled.

HarryHirsch 9y ago

Isn't Google supposed to be reviewing the apps? The real question is: who gets to say in what someone's phone is going to be doing: the programmer, the manufacturer or the phone's owner. Most everyone would agree that the owner should have a word in it, and that the manufacturer should have no say at all. Germany takes another approach: no one gets to do surveillance outside strict limits, privacy is highly regarded over there. The Guardian reports: https://www.theguardian.com/technology/2017/nov/18/germany-bans-childrens-smart-watches-over-surveillance-concerns https://www.theguardian.com/technology/2017/nov/18/germany-b...

nodesocket 9y ago
Unfortunately most phone owners are unaware of technical details, security, and privacy implications. I'd argue Apple has the right approach with their heavy handed reviews and security model.
greglindahl 9y ago
A better question is how can we give the owner a say without the typical owner getting pwned roughly 100% of the time? Which is what's happening on Android at the moment.
- HarryHirsch 9y ago
  Someone invoking "personal responsibility" usually means that they try to drop their responsibilities on someone else, but for car maintenance it actually works. People know they should change tires when they are getting bald and leave brake maintenance to their mechanic unless they really know what they are doing. Anyone who gives a game access to their contacts really had it coming to them. (Disclaimer: don't own a smartphone)
  - greglindahl 9y ago
    I recall that there are regulations about cars that make it more likely that a wide variety of owners will be able to maintain them successfully.
    - mulmen 9y ago
      Really? That's interesting, can you elaborate?
      - greglindahl 9y ago
        The US regulates "wear bars" on tires, which make it a lot more obvious when tires need to be replaced. I'm not saying that government regulation is needed, I'm just pointing out that the purpose of this tire feature is to make it more likely that people notice tire wear, and don't die from accidents involving bald tires.
        mulmen 9y ago
        Ah thank you for the clarification. I was thinking along the lines of a right to repair where maintenance tasks such as replacing filters are convenient. I would not attribute that to regulation as much as practicality in even mechanics working on the cars.
        jessaustin 9y ago
        Weren't there some BMWs that required a mechanic with a special tool just to refill the DEF tank?
        greglindahl 9y ago
        Is this getting a bit far afield from trying to balance phone owner responsibility with safety and ownership?
  - spookthesunset 9y ago
simonh 9y ago
>Most everyone would agree that the owner should have a word in it, and that the manufacturer should have no say at all. Isn’t setting the defaults behaviour ‘Having a say’, and who else but the manufacturer gets to do that? Sorry but this suggestion doesn’t make it past even 2 seconds of considered thought. Another few seconds - who gets to decide what privacy controls the phone even has, if not the manufacturer? Does this not count as having a say? I can see why some manufacturers would agree with you though, many of them give the impression they don’t want to have any responsibility in this area whatsoever.
- TheSpiceIsLife 9y ago
  > who gets to decide what privacy controls the phone even has Regulatory bodies and / or standards organisations. Some kind of "This devices meets or exceeds the International Organization for Standardization of mobile device security..." We don't even have a voluntary one of those.

deleted 9y ago

[deleted]

oldcynic 9y ago

Going on their website, it's not in the Android app store. Looks like you buy, download then side load it. There's no iOS version.

magnetic 9y ago

Whenever I would publish my app (or an update) on the Android Play Store, it seemed like it would be available almost immediately, which hints at the absence of review process. Also, I've never had to have a discussion with any "reviewer" about my app on Android. For iOS, I've always had to do quite a few back and forth interactions with the "Resolution Center". Android seems to be a pass through, perhaps after some automated checks are passing. As mentioned by others, you don't necessarily have to publish to the Play Store: apps can be side-loaded on Android.

newscracker 9y ago

This is by design. For the apps on Google Play Store, Google wouldn't look at these because it's been possible to do all these and more using the APIs provided by the Android OS all along, even before the granular runtime permission model came with Android 6 (Marshmallow). I always dread the thought of people not understanding these permissions and letting apps have all kinds of permissions — access to all text messsages, privilege to send text messages, access to call history and privilege to make calls. Many apps read the text messages to process one time passwords/codes sent as text messages, thus avoiding the user having to enter them manually. These privileges have never been available in iOS for third party apps, and I appreciate Apple deciding to err on this side of the privacy equation (though Apple could still do a lot more on app permissions). Taking the same example as above, iOS apps that need one time passwords/codes depend on the user to enter them manually.

duxup 9y ago
So many apps ask for permissions that I think most users just hit allow just to get past them. I think they absolutely don't understand them and there's nothing at the moment you're running the app to encourage you to learn.

deleted 9y ago

[deleted]

paul7986 9y ago

Unless that’s changed Google doesn’t review apps like Apple does.

deleted 9y ago

[deleted]

nitrogen 9y ago

As a regular Android user, I'll say that Android's permission model is simply awful. There's no way (in stock) to return blank data, so apps will simply shut down or silently malfunction if you refuse permissions. The grouping of permissions lumps "can portscan your network" and "run hidden in the background when your phone boots" under "Other", which you can't disable. J2ME had a more refined security model back in 2006.

smoyer 9y ago
There are so many applications I'd love to install but ... why do they insist on asking for permissions that they simply don't need for their stated functionality. <sarcasm>Of course you want your SSH terminal to have ties to the social networks</sarcasm>.
- tachyoff 9y ago
  “I just logged into my server! <Share on FB><Tweet this>” Yeah, that’s frustrating. Mobile app permissions are a gross nightmare.
jessaustin 9y ago
I agree, but many of the apps I've "crippled" using the following app still work as well as I need them to work: https://play.google.com/store/apps/details?id=com.gmail.heagoo.pmaster.pro https://play.google.com/store/apps/details?id=com.gmail.heag...
andymal 9y ago
APK devs should be checking to see if they have been granted permissions instead of crashing. https://developer.android.com/reference/android/support/v4/content/ContextCompat.html#checkSelfPermission(android.content.Context https://developer.android.com/reference/android/support/v4/c..., java.lang.String) If an application won't work after I've turned off all the permissions that it shouldn't need, it simply gets uninstalled.