3 ms·

There's a paper linked from the article which contains details on the sidechannels: https://www.ftc.gov/system/files/documents/public_events/1415032/privacycon2

There's a paper linked from the article which contains details on the sidechannels: https://www.ftc.gov/system/files/documents/public_events/1415032/privacycon2019_serge_egelman.pdf https://www.ftc.gov/system/files/documents/public_events/141... Example: if you have an SD card installed, one advertising SDK creates a file on it. When the SDK is running in an app with appropriate permissions, it writes the IMEI and advertising ID to that file. When it's running in an app without appropriate permissions, it retrieves the IMEI and advertising ID from that file. Lots of interesting tricks. The one that surprises me the most is Unity using ioctl tricks to harvest the device's MAC address.

deleted 7y ago
[deleted]
yegle 7y ago
For this specific issue, I believe https://developer.android.com/preview/privacy/scoped-storage https://developer.android.com/preview/privacy/scoped-storage is the solution. Too bad many Android developers are opposing this feature (e.g. previous discussion: https://news.ycombinator.com/item?id=19521211 https://news.ycombinator.com/item?id=19521211).
- BryantD 7y ago
  Yeah, that seems like the right answer. However, I think you still have to hold developers responsible for clever tricks that violate the intent of the Android permissions system. There are always going to be loopholes. (This likewise means that there has to be room for developers to make honest mistakes.)
- Ajedi32 7y ago
  Loos like that system also fixes the "steal user location data from pictures metadata" bypass: https://developer.android.com/preview/privacy/scoped-storage#photos-location-info https://developer.android.com/preview/privacy/scoped-storage...
- altfredd 7y ago
  Scoped storage does not prevent applications from sharing PII with each other. There are already advertising networks, using BroadcastReceivers and ContentProviders to share analytics data — it is simple and does not require individual apps to have external storage access.

deleted 7y ago

[deleted]

yegle 7y ago

For this specific issue, I believe https://developer.android.com/preview/privacy/scoped-storage https://developer.android.com/preview/privacy/scoped-storage is the solution. Too bad many Android developers are opposing this feature (e.g. previous discussion: https://news.ycombinator.com/item?id=19521211 https://news.ycombinator.com/item?id=19521211).

BryantD 7y ago
Yeah, that seems like the right answer. However, I think you still have to hold developers responsible for clever tricks that violate the intent of the Android permissions system. There are always going to be loopholes. (This likewise means that there has to be room for developers to make honest mistakes.)
Ajedi32 7y ago
Loos like that system also fixes the "steal user location data from pictures metadata" bypass: https://developer.android.com/preview/privacy/scoped-storage#photos-location-info https://developer.android.com/preview/privacy/scoped-storage...
altfredd 7y ago
Scoped storage does not prevent applications from sharing PII with each other. There are already advertising networks, using BroadcastReceivers and ContentProviders to share analytics data — it is simple and does not require individual apps to have external storage access.