4 ms·

Things overheard on the WiFi from my Android smartphone

54 points by akent 16y ago

akent 16y ago
Disturbing: "SoundHound and ShopSaavy transmit your fine GPS coordinates whenever you make a request to them."
- mhansen 16y ago
  Not that disturbing. They ask for these permissions when you install them.
  - akent 16y ago
    Sure. And I chose not to install because of that. But why do they need them? SoundHound claim location information is "saved with your searches in History to help you remember where you heard the song. This can be disabled under Options." http://www.appbrain.com/app/soundhound/com.melodis.midomiMusicIdentifier.freemium http://www.appbrain.com/app/soundhound/com.melodis.midomiMus... ... which is a nice idea, but why does it need to transmit your coordinates over the network?
    - dotBen 16y ago
      But why do they need them? (warning, litteral answer ahead) Because the makers of the app want to use location to obtain better quality adverts for the financial return of their app. (or at least, their agents/brokers who place the ads want to do that on their behalf). If you are playing a game or an app with litte monetizable intention-orientated behavior (eg a shoe shopping app would have shoe orientated adverts) then you need to use something like location to at least get one dimension of context. If you don't want the GPS locations going up, perhaps you should buy the paid version of the app (most do have a paid, no-ad version).
      - akent 16y ago
        Reasonable explanation. However the paid version of SoundHound still requests location permissions. One would hope then it would only be used as they claim, for storing history locally and the data would not be sent over the network. Anyone fancy sniffing the traffic from a paid version to see if it is still sending GPS data?
      - linhat 16y ago
        Maybe they use the location information to improve their service (i'm really just imagining here). You hear a song somewhere, a club, a bus, wherever and Soundhound is able to identify it. Somebody near you hears the same sound, but Soundhound can't identify it, maybe it is to noisy, the sound to low, for whatever reason they can't tell you what song it is, but they have the good recognition from somebody close to you, so they might be able to narrow it down... Again, just hypothetical, that's just what i would do from an engineer's perspective, i'm almost sure, they are not doing anything fancy like this.
        wallflower 16y ago
        I thought this article in the NYTimes was interesting because it revealed that music identification software companies have former talent scouts working to identify new, trendy music before it goes mainstream. http://www.nytimes.com/2011/02/14/technology/14shazam.html?_r=2&pagewanted=all http://www.nytimes.com/2011/02/14/technology/14shazam.html?_...
  - jsankey 16y ago
    Unfortunately it's too easy for people just to hit the OK button at install time without thinking about it/realising what they are agreeing too. Whilst the user has to take some responsibility for this, maybe it would be more obvious if the system prompted the user the first time an application tries to use some permission. Then they would see the context in which, e.g., their location is accessed.
wallflower 16y ago
I don't care that much about the GPS function since that is usually sent over 3G/4G (which in theory is harder to sniff). But the apps that request access to your Contacts? I wanted to install an application recently (some recipe thing that had good UX) but it requested READ_CONTACTS. So I balked and didn't install it. Why did a recipe app need access to my Contacts? To be fair, all of your iOS Contacts are wide-open to any SDK app (they never bothered to lock it down like GPS). I think the real solution is something like LittleSnitch for Droid. It would have to be installed as a Root process though on a rooted phone. http://developer.android.com/reference/android/Manifest.permission.html http://developer.android.com/reference/android/Manifest.perm...
- krobertson 16y ago
  In their case, it sounds like GPS was sent over wifi by the apps. But the bigger thing is regarding why those apps need GPS coordinates. Much like a recipe app needing contacts, and app that doesn't need to know my location shouldn't be transmitting it.
  - nl 16y ago
    In the comments attached to that post the creator of ShopSavvy pointed out that it is a local shopping app, that by design needs to know your location - that's kind of the point of the app. The reply was that he'd prefer to have options about the degree of accuracy given to the app. While I can see that argument, at the current point in time I think ShopSavvy is doing the correct thing by it's users (ie, simplifying things, and removing unnecessary options)
- kaerast 16y ago
  It wouldn't matter if GPS info went out over wifi rather than 3G/4G. If you're close enough to sniff wifi then you are probably close enough to have some idea where in the world they are.
- JonnieCache 16y ago
  On the contacts thing, this is probably needed for the "send this thing to a friend" functionality, so the app can pull email addresses out of the contacts db. When an app wants contacts permissions when it doesnt have an obvious reason, this is usually it.
pnathan 16y ago
What I found fascinating was the Mallory MITM 'testing' program. https://bitbucket.org/IntrepidusGroup/mallory https://bitbucket.org/IntrepidusGroup/mallory http://intrepidusgroup.com/insight/2010/12/mallory-and-me-setting-up-a-mobile-mallory-gateway/ http://intrepidusgroup.com/insight/2010/12/mallory-and-me-se...
bitexploder 16y ago
Hello. I am one of the main authors of Mallory, the tool used to perform the MiTM in the linked blog post. I just updated our Mallory home page a bit (http://intrepidusgroup.com/insight/mallory/ http://intrepidusgroup.com/insight/mallory/) to be more helpful. If you have any questions on running Mallory let me know. Mallory does a lot of MiTM things and is primarily a testing tool we use to break mobile applications. The best feature that is hard to find elsewhere is live TCP stream pausing and editing. We will be releasing a new version at SOURCE Boston next week that beats the pants off of the current "stable" version in terms of usability (the new version is the head on our bitbucket repo). :)

54 points by akent 16y ago

akent 16y ago

Disturbing: "SoundHound and ShopSaavy transmit your fine GPS coordinates whenever you make a request to them."

mhansen 16y ago
Not that disturbing. They ask for these permissions when you install them.
- akent 16y ago
  Sure. And I chose not to install because of that. But why do they need them? SoundHound claim location information is "saved with your searches in History to help you remember where you heard the song. This can be disabled under Options." http://www.appbrain.com/app/soundhound/com.melodis.midomiMusicIdentifier.freemium http://www.appbrain.com/app/soundhound/com.melodis.midomiMus... ... which is a nice idea, but why does it need to transmit your coordinates over the network?
  - dotBen 16y ago
    But why do they need them? (warning, litteral answer ahead) Because the makers of the app want to use location to obtain better quality adverts for the financial return of their app. (or at least, their agents/brokers who place the ads want to do that on their behalf). If you are playing a game or an app with litte monetizable intention-orientated behavior (eg a shoe shopping app would have shoe orientated adverts) then you need to use something like location to at least get one dimension of context. If you don't want the GPS locations going up, perhaps you should buy the paid version of the app (most do have a paid, no-ad version).
    - akent 16y ago
      Reasonable explanation. However the paid version of SoundHound still requests location permissions. One would hope then it would only be used as they claim, for storing history locally and the data would not be sent over the network. Anyone fancy sniffing the traffic from a paid version to see if it is still sending GPS data?
    - linhat 16y ago
      Maybe they use the location information to improve their service (i'm really just imagining here). You hear a song somewhere, a club, a bus, wherever and Soundhound is able to identify it. Somebody near you hears the same sound, but Soundhound can't identify it, maybe it is to noisy, the sound to low, for whatever reason they can't tell you what song it is, but they have the good recognition from somebody close to you, so they might be able to narrow it down... Again, just hypothetical, that's just what i would do from an engineer's perspective, i'm almost sure, they are not doing anything fancy like this.
      - wallflower 16y ago
        I thought this article in the NYTimes was interesting because it revealed that music identification software companies have former talent scouts working to identify new, trendy music before it goes mainstream. http://www.nytimes.com/2011/02/14/technology/14shazam.html?_r=2&pagewanted=all http://www.nytimes.com/2011/02/14/technology/14shazam.html?_...
- jsankey 16y ago
  Unfortunately it's too easy for people just to hit the OK button at install time without thinking about it/realising what they are agreeing too. Whilst the user has to take some responsibility for this, maybe it would be more obvious if the system prompted the user the first time an application tries to use some permission. Then they would see the context in which, e.g., their location is accessed.

wallflower 16y ago

I don't care that much about the GPS function since that is usually sent over 3G/4G (which in theory is harder to sniff). But the apps that request access to your Contacts? I wanted to install an application recently (some recipe thing that had good UX) but it requested READ_CONTACTS. So I balked and didn't install it. Why did a recipe app need access to my Contacts? To be fair, all of your iOS Contacts are wide-open to any SDK app (they never bothered to lock it down like GPS). I think the real solution is something like LittleSnitch for Droid. It would have to be installed as a Root process though on a rooted phone. http://developer.android.com/reference/android/Manifest.permission.html http://developer.android.com/reference/android/Manifest.perm...

krobertson 16y ago
In their case, it sounds like GPS was sent over wifi by the apps. But the bigger thing is regarding why those apps need GPS coordinates. Much like a recipe app needing contacts, and app that doesn't need to know my location shouldn't be transmitting it.
- nl 16y ago
  In the comments attached to that post the creator of ShopSavvy pointed out that it is a local shopping app, that by design needs to know your location - that's kind of the point of the app. The reply was that he'd prefer to have options about the degree of accuracy given to the app. While I can see that argument, at the current point in time I think ShopSavvy is doing the correct thing by it's users (ie, simplifying things, and removing unnecessary options)
kaerast 16y ago
It wouldn't matter if GPS info went out over wifi rather than 3G/4G. If you're close enough to sniff wifi then you are probably close enough to have some idea where in the world they are.
JonnieCache 16y ago
On the contacts thing, this is probably needed for the "send this thing to a friend" functionality, so the app can pull email addresses out of the contacts db. When an app wants contacts permissions when it doesnt have an obvious reason, this is usually it.

pnathan 16y ago

What I found fascinating was the Mallory MITM 'testing' program. https://bitbucket.org/IntrepidusGroup/mallory https://bitbucket.org/IntrepidusGroup/mallory http://intrepidusgroup.com/insight/2010/12/mallory-and-me-setting-up-a-mobile-mallory-gateway/ http://intrepidusgroup.com/insight/2010/12/mallory-and-me-se...

bitexploder 16y ago

Hello. I am one of the main authors of Mallory, the tool used to perform the MiTM in the linked blog post. I just updated our Mallory home page a bit (http://intrepidusgroup.com/insight/mallory/ http://intrepidusgroup.com/insight/mallory/) to be more helpful. If you have any questions on running Mallory let me know. Mallory does a lot of MiTM things and is primarily a testing tool we use to break mobile applications. The best feature that is hard to find elsewhere is live TCP stream pausing and editing. We will be releasing a new version at SOURCE Boston next week that beats the pants off of the current "stable" version in terms of usability (the new version is the head on our bitbucket repo). :)