4 ms·

So the main purpose of new technology is to help corporations spy on people. Google Maps wants to know where you go, Facebook wants to know whom do you call, ch

So the main purpose of new technology is to help corporations spy on people. Google Maps wants to know where you go, Facebook wants to know whom do you call, chinese SDKs want their share of data. Some time ago I looked into Uber app and saw inside a Baidu SDK if I remember correctly. It had the class that was collecting WiFi network ids and sending them to some server. Of course, I cannot say that this code was really invoked by the app, but anyway this was very suspicious. Some regulation is definitely necessary. The market cannot do anything with it and it needs help.

codedokode 9y ago
Imagine if you invited an electrician to your house to fix something, but he would secretly search for your documents and copied them. That is what many apps do today. They advertise themselves as a game or as a map app but secretly they spy on you or use your phone for their purposes.
- tn_ 9y ago
  That's not a fair comparison. Imagine if you hired an electrician for no money, and you kept using them over and over again. I expect if I were to pay for an alternative to not have my privacy violated.
  - blunte 9y ago
    As Walmart has proven, people will choose cheaper over their own long term benefit (and especially the benefit of others)
    - unit91 9y ago
      > cheaper over their own long term benefit You're assuming you know better than millions who believe cheaper IS in their long term benefit. Quite a sweeping statement!
      - raarts 9y ago
        You're believing those millions actually consciously make that decision. Quite a sweeping statement.
  - codedokode 9y ago
    It doesn't matter. If an electrian says he will work for free it doesn't give him any special rights to do anything except his job. It is sad that some people in Silicon Valley find it acceptable and ethical.
    - BoorishBears 9y ago
      They don’t say they’ll work for free, they say they’ll work in exchange for your data, which they will then sell
      - s73v3r_ 9y ago
        Where do they come out and say that? Where do they put a message, in readable english, and not buried under a thousand other things, that says they'll do that?
        megy 9y ago
        I guess you could say they do that when they ask for permission to you camera, to your call list, etc...
        codedokode 9y ago
        Allowing the app to access the contact list doesn't mean that the user allows to upload call history to the server. Maybe they only want to add one of the people from their contact list.
        BoorishBears 9y ago
        I agree privacy policy details are opaque, but it takes the bare minimum of skimming to know if the policy is not giving up your data. It should be clear as day what’s being collected and it’s a failing that it’s not, but there’s also the old adage of “if it’s too good to be true...” doing some due diligence when you’re promised the services of a billion dollar company that’s not charging you is prudent.
      - codedokode 9y ago
  - endorphone 9y ago
    I expect if I were to pay for an alternative to not have my privacy violated. The whole free versus pay argument is sophistry. Many pay products usurp your privacy. Your television is selling your viewing habits. Your car telematics solution is selling your movements. That operating system is mining your activity to sell you things. And many free products defend your privacy. Linux, VLC, Firefox, IPF, and on and on. More concerned for your privacy than any other product. So can we please stop this binary differentiation. It isn't useful.
  - confounded 9y ago
    How are you using Uber without paying?
craftyguy 9y ago
> Some time ago I As much as I'd like to believe this anecdote, more proof to back you up would be nice. It's becoming super easy to post weightless stories here similar to this one, and I'd like to see the (rough?) integrity of HN somewhat preserved a little longer.
- codedokode 9y ago
  Ok, I looked through old files and found the details. First, you need to get the file Uber_v3.86.5_apkpure.com.apk (Uber app) and decompile it. You can decompile a later version but I cannot guarantee that all the files are still there. In case you don't have decompiling tools around, I found that someone has uploaded files from the directory 'classes/com/baidu/' here: http://rgho.st/8WlHPJC8g http://rgho.st/8WlHPJC8g To find the code that scans WiFi networks, grep the files for getScanResults which is the method name from Android API. You will find a file classes/com/baidu/android/pushservice/util/l.java (and several other files). Someone posted this file here: https://pastebin.com/6cXv2itK https://pastebin.com/6cXv2itK If you look at the method public static String a(Context paramContext, String paramString) at line 114 you'll see that it gets WiFi scan results and then does something that looks like composing a POST request to https://cp01-rdqa-dev404.cp01.baidu.com:8443/rest/2.0/zwifi/getzidwifiinfo https://cp01-rdqa-dev404.cp01.baidu.com:8443/rest/2.0/zwifi/... (which doesn't resolve currently). I didn't have time to examine the code thoroughly. By the way, the code in a paper [1] mentions a shared property named "pst": SharedPreferences localSharedPreferences = paramContext.getSharedPreferences("pst", 0); If you search Uber sources for "pst", you'll find a file classes/com/baidu/frontia/a/d/b$b.java (here: https://pastebin.com/4zDp8dSz https://pastebin.com/4zDp8dSz ) that also uses this property: localObject1 = "pst"; ... localObject1 = paramContext.getSharedPreferences((String)localObject1, 0); You can also search for "push_sync", which was mentioned in the paper, and you'll find that several files contain this string: classes/com/baidu/android/pushservice/c/b.java classes/com/baidu/android/pushservice/PushLightapp.java classes/com/baidu/android/pushservice/PushManager.java classes/com/baidu/android/pushservice/util/i.java You can also search for other keywords, for example 'http' and you'll find interesting URLs like 'http://127.0.0.1:7777/native' http://127.0.0.1:7777/native'. Finally, you can search for getSubscriberId which is an Android API method that returns an IMSI and you'll also find several matches: classes/com/baidu/location/h/b.java classes/com/baidu/platform/comapi/util/f.java classes/com/baidu/vi/VDeviceAPI.java classes/com/baidu/android/pushservice/message/f.java [1] https://www.virusbulletin.com/virusbulletin/2018/03/vb2016-paper-wild-android-collusions/ https://www.virusbulletin.com/virusbulletin/2018/03/vb2016-p...

codedokode 9y ago

Imagine if you invited an electrician to your house to fix something, but he would secretly search for your documents and copied them. That is what many apps do today. They advertise themselves as a game or as a map app but secretly they spy on you or use your phone for their purposes.

tn_ 9y ago
That's not a fair comparison. Imagine if you hired an electrician for no money, and you kept using them over and over again. I expect if I were to pay for an alternative to not have my privacy violated.
- blunte 9y ago
  As Walmart has proven, people will choose cheaper over their own long term benefit (and especially the benefit of others)
  - unit91 9y ago
    > cheaper over their own long term benefit You're assuming you know better than millions who believe cheaper IS in their long term benefit. Quite a sweeping statement!
    - raarts 9y ago
      You're believing those millions actually consciously make that decision. Quite a sweeping statement.
- codedokode 9y ago
  It doesn't matter. If an electrian says he will work for free it doesn't give him any special rights to do anything except his job. It is sad that some people in Silicon Valley find it acceptable and ethical.
  - BoorishBears 9y ago
    They don’t say they’ll work for free, they say they’ll work in exchange for your data, which they will then sell
    - s73v3r_ 9y ago
      Where do they come out and say that? Where do they put a message, in readable english, and not buried under a thousand other things, that says they'll do that?
      - megy 9y ago
        I guess you could say they do that when they ask for permission to you camera, to your call list, etc...
        codedokode 9y ago
        Allowing the app to access the contact list doesn't mean that the user allows to upload call history to the server. Maybe they only want to add one of the people from their contact list.
      - BoorishBears 9y ago
        I agree privacy policy details are opaque, but it takes the bare minimum of skimming to know if the policy is not giving up your data. It should be clear as day what’s being collected and it’s a failing that it’s not, but there’s also the old adage of “if it’s too good to be true...” doing some due diligence when you’re promised the services of a billion dollar company that’s not charging you is prudent.
    - codedokode 9y ago
- endorphone 9y ago
  I expect if I were to pay for an alternative to not have my privacy violated. The whole free versus pay argument is sophistry. Many pay products usurp your privacy. Your television is selling your viewing habits. Your car telematics solution is selling your movements. That operating system is mining your activity to sell you things. And many free products defend your privacy. Linux, VLC, Firefox, IPF, and on and on. More concerned for your privacy than any other product. So can we please stop this binary differentiation. It isn't useful.
- confounded 9y ago
  How are you using Uber without paying?

craftyguy 9y ago

> Some time ago I As much as I'd like to believe this anecdote, more proof to back you up would be nice. It's becoming super easy to post weightless stories here similar to this one, and I'd like to see the (rough?) integrity of HN somewhat preserved a little longer.

codedokode 9y ago
Ok, I looked through old files and found the details. First, you need to get the file Uber_v3.86.5_apkpure.com.apk (Uber app) and decompile it. You can decompile a later version but I cannot guarantee that all the files are still there. In case you don't have decompiling tools around, I found that someone has uploaded files from the directory 'classes/com/baidu/' here: http://rgho.st/8WlHPJC8g http://rgho.st/8WlHPJC8g To find the code that scans WiFi networks, grep the files for getScanResults which is the method name from Android API. You will find a file classes/com/baidu/android/pushservice/util/l.java (and several other files). Someone posted this file here: https://pastebin.com/6cXv2itK https://pastebin.com/6cXv2itK If you look at the method public static String a(Context paramContext, String paramString) at line 114 you'll see that it gets WiFi scan results and then does something that looks like composing a POST request to https://cp01-rdqa-dev404.cp01.baidu.com:8443/rest/2.0/zwifi/getzidwifiinfo https://cp01-rdqa-dev404.cp01.baidu.com:8443/rest/2.0/zwifi/... (which doesn't resolve currently). I didn't have time to examine the code thoroughly. By the way, the code in a paper [1] mentions a shared property named "pst": SharedPreferences localSharedPreferences = paramContext.getSharedPreferences("pst", 0); If you search Uber sources for "pst", you'll find a file classes/com/baidu/frontia/a/d/b$b.java (here: https://pastebin.com/4zDp8dSz https://pastebin.com/4zDp8dSz ) that also uses this property: localObject1 = "pst"; ... localObject1 = paramContext.getSharedPreferences((String)localObject1, 0); You can also search for "push_sync", which was mentioned in the paper, and you'll find that several files contain this string: classes/com/baidu/android/pushservice/c/b.java classes/com/baidu/android/pushservice/PushLightapp.java classes/com/baidu/android/pushservice/PushManager.java classes/com/baidu/android/pushservice/util/i.java You can also search for other keywords, for example 'http' and you'll find interesting URLs like 'http://127.0.0.1:7777/native' http://127.0.0.1:7777/native'. Finally, you can search for getSubscriberId which is an Android API method that returns an IMSI and you'll also find several matches: classes/com/baidu/location/h/b.java classes/com/baidu/platform/comapi/util/f.java classes/com/baidu/vi/VDeviceAPI.java classes/com/baidu/android/pushservice/message/f.java [1] https://www.virusbulletin.com/virusbulletin/2018/03/vb2016-paper-wild-android-collusions/ https://www.virusbulletin.com/virusbulletin/2018/03/vb2016-p...