7 ms·

EFF and EU should respond to Google taking FairEmail off the Play store

151 points by rapnie 4y ago

ZephyrOhm 4y ago
FairEmail is one of 5 apps I have ever felt motivated to purchase the pro version. It's unparalleled in it's performance, privacy, and battery efficiency. Don't give up Marcel
vfclists 4y ago
Roger this
VWWHFSfQ 4y ago
> Google keeps harassing the developer as it considers the app as "spyware", but it refuses to provide ANY details about their findings, or inform the developer on what they are supposed to change to get the app approved again. It seems like about 9/10 times when Google removes an app it's because it is actually doing some very shady spyware type stuff. I'll be interested to see what this email app is doing. And just being open source means nothing. Nobody knows what code was submitted to the Play store.
- g_p 4y ago
  Very often, the policy violation cited is very very broad, and "worst case", but not enough information is given to find the specific issue. In this case, it is my understanding that firstly it isn't clear what the actual allegation is (making it very unhelpful for the developer, as they can't meaningfully respond), but that the suspicion is it may be linked to an (off by default) option to show the favicon of a sending email domain. That would entail making a DNS request to the domain in question, and then looking for a favicon on the domain. That doesn't seem in any way related to spyware as it's off by default, user requested, and not sending information to a third party. Valid point around the exact APK uploaded for distribution - I'm not sure of the state of the art for reproducible builds on Android, but the full gradle configs are in the repo for creating GitHub or Play Store releases as far as I can see - if reproducibility in android has got any better, you can likely get to the same binary, modulo API keys and similar, as the developer seems pretty diligent at tagging releases etc.
- nimbius 4y ago
  and as a counterpoint: FDroid gave FairEmail a clean bill of health. FairEmail, if popular, would give users the unfortunate ability to sidestep an appendage of the lucrative ecosystem of googles surveillance capitalism by eschewing the default email client.
  - VWWHFSfQ 4y ago
    > FDroid gave FairEmail a clean bill of health. This means nothing.
  - alaricus 4y ago
    I trust FDroid more than I trush Google.
    - Avamander 4y ago
      I'd rather not trust either. Right now both can impersonate any developer out there and nobody would be any wiser.
      - alaricus 4y ago
        true. but fdroid has the better track record.
  - Xylakant 4y ago
    Why would google care about the email client people use. They may care about the email provider people use, because that‘s where all data passes through. But I‘m fairly certain that for all they care, you could have your mail printed or view them as an expressive modern dance piece.
    - pwg 4y ago
      > Why would google care about the email client people use. Because the "client" is where advertising can be most easily inserted to monetize that user.
- JasonFruit 4y ago
  > about 9/10 times when Google removes an app it's because it is actually doing some very shady spyware type stuff If Google removes apps for invalid reasons 1/10 the time, that's a big window for abuse.
- vfclists 4y ago
  "It seems"??? Really? That suggests you don't know what you are talking about. You are talking about a very popular app. If it is doing something shady shouldn't there be hard evidence by now?
- prepend 4y ago
  Imagine if the power company cut off people’s electricity in error 1/10 of the time. That’s insane and dangerous. Apps are an important part of the economy and having a false positive rate of 10% when the consequence is severely harming a company is unacceptable. Not sure if it means regulators should get involved but Google (and to a certain extent Apple) have had this problem for many years and it doesn’t seem like market forces are going to change their policy. I think the angle to take here is that Google is being anticompetitive by blocking a mail competitor from Android. So I think anti-trust is the existing set of laws that apply and hopefully will be pursued. Hopefully it’s just Google’s stupidity and not malice, but I think all the data to determine that is private and confidential to Google so requires some legal compulsion for evidence in order to investigate.
- alaricus 4y ago
  If this statistics is true, then Google is removing lots and lots of legitimate apps. This is exactly why a monopoly is bad. 90% is nowhere close enough accuracy for such a system.
- deleted 4y ago
  [deleted]
- sdflhasjd 4y ago
  In my experience 9/10 times are spurious detections. Just recently, we had 2 customers that had their apps suspended because Google detected a non-existent HockeySDK
- bryanlarsen 4y ago
  according to boole1854[1] the app was uploading contacts to be able to download favicons, without disclosing that it was uploading contacts. 1: https://news.ycombinator.com/item?id=31434975 https://news.ycombinator.com/item?id=31434975
  - g_p 4y ago
    Looking at the code, it wasn't uploading contacts - rather it retrieved the favicons by looking on the domain in question, when a user turned that feature on manually. Some apps do upload user contacts - they take the whole list, and cart it off to their own server. The app doesn't seem to be sending anything to its own server - it's fetching something the user asked it to fetch.
- coffeeblack 4y ago
  Could you post the source for the 9/10 claim? Thanks!
- sureglymop 4y ago
  You should also know that this is the developer of the popular Xposed modules XPrivacy and XPrivacyLua. These modules allow one to 'spoof' data to apps on Android, such as the wifi SSID, device identifier, etc. It is a lot more fine grained and in depth than Androids default permissions. Not saying that has something to do with this but it is something to keep in mind, politically speaking.
SpicyLemonZest 4y ago
> Email clients alternative to Gmail, as well as any app that accesses what Google deems "sensitive user data" (including emails, calendar, fit data etc.) will now require an expensive (talking of at least $4500 a year) and intentionally cumbersome certification process, and such a certification needs to be renewed on a yearly basis Isn't Google required under the GDPR to verify the security and privacy compliance of any third party apps they send user data to? This really starts to cast doubt on the rest of the story for me; any app developer who hasn't been hiding under a rock since 2010 must know why modern companies insist on certifying third party apps with API access.
- alaricus 4y ago
- deleted 4y ago
  [deleted]
- bcrosby95 4y ago
  If that were true, wouldn't Google have to verify the security and privacy compliance of every browser out there?
  - SpicyLemonZest 4y ago
    I confess that I don't have a clear understanding of why browsers never seem to count in privacy discussions.
- abofh 4y ago
  The GDPR prohibits companies sharing customer data with third parties without consent of the customer. It most certainly does not prohibit customers disclosing their own data to third parties.
  - contravariant 4y ago
    Also, if I run software then it's first party.
encryptluks2 4y ago
Respond how exactly? The last thing you want to do as an organization like this is to take action and then find out that the removal was warranted. I think it is up to the app developer to supply sufficient information to show that it was not warranted. In another posts, someone already showed where they are essentially uploading contacts to remote servers. I agree it sucks cause I had seen the app on F-Droid and it looks like it was actively developed, but the developer stopping development because of the Play Store removal doesn't help instill confidence. Otherwise, they'd just continue development and support F-Droid and alternative Play Store initiatives.
- sreevisakh 4y ago
  Why do the threads about FairMail contain so much misinformation? It wasn't uploading the contacts to any server. It was fetching favicons from the domains of each contact. That too was opt-in. It feels like there is an effort to discredit Fairmail here.
- upofadown 4y ago
  Some sort of competition related action would be the obvious answer. Google is using their market power to harass an alternative to their data collection funded services.
  - encryptluks2 4y ago
    That is why it is called Play Store policies. You want to go after an anti-competitive company, at least target Apple first who won't even let you sideload apps.
    - Dylan16807 4y ago
      Nah we can do both.
- Brian_K_White 4y ago
  The developer is obligated to prove that they aren't guilty of something without being told what that thing is? Other people's detective work is just guessing. Google has not given any specific instructions, and so they cannot be followed. It IS on Google to be fair here. If the action is so hainous, then they can certainly say "this action is not allowed" so that the developer can satisfy them. List all the reasons why Google might not do that, and find a single one of them that's valid.
onphonenow 4y ago
The developer was scraping contact lists and using that to query third party servers. That is explicitly forbidden by google without permission from the user. He then repeatedly refused to fix the issue. They should perm-ban folks like this who don't take user privacy concerns seriously. Separately, it looks like he is using unsupported API calls potentially which are going to cause crashing problems - that may be a factor in their eval. Having dealt with situations where user error / issues were 99 to 1 the source of problems, the majority for just a failure to read the instructions, whoever has to deal with this stuff on the google side has got to be annoyed at both these app devs and their social media followings.
- Ruthalas 4y ago
  Can you provide a source for the contact list scraping? I currently use FairEmail, so that's a concern for me, but I'd not heard that it was happening in this conversation so far.
  - Semaphor 4y ago
    This has some details and a code link: https://news.ycombinator.com/item?id=31434975 https://news.ycombinator.com/item?id=31434975
    - Ruthalas 4y ago
      Thank you!
  - g_p 4y ago
    It seems like this was an opt-in feature, that was off by default, that allowed users to have a domain's favicon shown alongside the message. It doesn't seem like any contact info was sent. Indeed, if you go to the effort of turning on favicon showing, it also seems pretty obvious and intuitive the app will retrieve the favicon. And the way it's done here seems to be more privacy preserving than having a central server do this (and see what you request). This feels a bit to me like Google saying "web browser leaks details of your requests to a third party" - alarming, until you realise the third party is the DNS server, and that's how the internet works.
dang 4y ago
Related ongoing thread: FairEmail stopping development after Google falsely flags app as spyware - https://news.ycombinator.com/item?id=31432334 https://news.ycombinator.com/item?id=31432334 - May 2022 (238 comments)
vfclists 4y ago
Common sense says the developer is giving up because it is not worth it, ie not enough people buy the software or donate to support its development. Android users it is time you forked out more to support free software developers.

151 points by rapnie 4y ago

FairEmail is one of 5 apps I have ever felt motivated to purchase the pro version. It's unparalleled in it's performance, privacy, and battery efficiency. Don't give up Marcel

vfclists 4y ago

Roger this

VWWHFSfQ 4y ago

> Google keeps harassing the developer as it considers the app as "spyware", but it refuses to provide ANY details about their findings, or inform the developer on what they are supposed to change to get the app approved again. It seems like about 9/10 times when Google removes an app it's because it is actually doing some very shady spyware type stuff. I'll be interested to see what this email app is doing. And just being open source means nothing. Nobody knows what code was submitted to the Play store.

g_p 4y ago
Very often, the policy violation cited is very very broad, and "worst case", but not enough information is given to find the specific issue. In this case, it is my understanding that firstly it isn't clear what the actual allegation is (making it very unhelpful for the developer, as they can't meaningfully respond), but that the suspicion is it may be linked to an (off by default) option to show the favicon of a sending email domain. That would entail making a DNS request to the domain in question, and then looking for a favicon on the domain. That doesn't seem in any way related to spyware as it's off by default, user requested, and not sending information to a third party. Valid point around the exact APK uploaded for distribution - I'm not sure of the state of the art for reproducible builds on Android, but the full gradle configs are in the repo for creating GitHub or Play Store releases as far as I can see - if reproducibility in android has got any better, you can likely get to the same binary, modulo API keys and similar, as the developer seems pretty diligent at tagging releases etc.
nimbius 4y ago
and as a counterpoint: FDroid gave FairEmail a clean bill of health. FairEmail, if popular, would give users the unfortunate ability to sidestep an appendage of the lucrative ecosystem of googles surveillance capitalism by eschewing the default email client.
- VWWHFSfQ 4y ago
  > FDroid gave FairEmail a clean bill of health. This means nothing.
- alaricus 4y ago
  I trust FDroid more than I trush Google.
  - Avamander 4y ago
    I'd rather not trust either. Right now both can impersonate any developer out there and nobody would be any wiser.
    - alaricus 4y ago
      true. but fdroid has the better track record.
- Xylakant 4y ago
  Why would google care about the email client people use. They may care about the email provider people use, because that‘s where all data passes through. But I‘m fairly certain that for all they care, you could have your mail printed or view them as an expressive modern dance piece.
  - pwg 4y ago
    > Why would google care about the email client people use. Because the "client" is where advertising can be most easily inserted to monetize that user.
JasonFruit 4y ago
> about 9/10 times when Google removes an app it's because it is actually doing some very shady spyware type stuff If Google removes apps for invalid reasons 1/10 the time, that's a big window for abuse.
vfclists 4y ago
"It seems"??? Really? That suggests you don't know what you are talking about. You are talking about a very popular app. If it is doing something shady shouldn't there be hard evidence by now?
prepend 4y ago
Imagine if the power company cut off people’s electricity in error 1/10 of the time. That’s insane and dangerous. Apps are an important part of the economy and having a false positive rate of 10% when the consequence is severely harming a company is unacceptable. Not sure if it means regulators should get involved but Google (and to a certain extent Apple) have had this problem for many years and it doesn’t seem like market forces are going to change their policy. I think the angle to take here is that Google is being anticompetitive by blocking a mail competitor from Android. So I think anti-trust is the existing set of laws that apply and hopefully will be pursued. Hopefully it’s just Google’s stupidity and not malice, but I think all the data to determine that is private and confidential to Google so requires some legal compulsion for evidence in order to investigate.
alaricus 4y ago
If this statistics is true, then Google is removing lots and lots of legitimate apps. This is exactly why a monopoly is bad. 90% is nowhere close enough accuracy for such a system.
deleted 4y ago
[deleted]
sdflhasjd 4y ago
In my experience 9/10 times are spurious detections. Just recently, we had 2 customers that had their apps suspended because Google detected a non-existent HockeySDK
bryanlarsen 4y ago
according to boole1854[1] the app was uploading contacts to be able to download favicons, without disclosing that it was uploading contacts. 1: https://news.ycombinator.com/item?id=31434975 https://news.ycombinator.com/item?id=31434975
- g_p 4y ago
  Looking at the code, it wasn't uploading contacts - rather it retrieved the favicons by looking on the domain in question, when a user turned that feature on manually. Some apps do upload user contacts - they take the whole list, and cart it off to their own server. The app doesn't seem to be sending anything to its own server - it's fetching something the user asked it to fetch.
coffeeblack 4y ago
Could you post the source for the 9/10 claim? Thanks!
sureglymop 4y ago
You should also know that this is the developer of the popular Xposed modules XPrivacy and XPrivacyLua. These modules allow one to 'spoof' data to apps on Android, such as the wifi SSID, device identifier, etc. It is a lot more fine grained and in depth than Androids default permissions. Not saying that has something to do with this but it is something to keep in mind, politically speaking.

SpicyLemonZest 4y ago

> Email clients alternative to Gmail, as well as any app that accesses what Google deems "sensitive user data" (including emails, calendar, fit data etc.) will now require an expensive (talking of at least $4500 a year) and intentionally cumbersome certification process, and such a certification needs to be renewed on a yearly basis Isn't Google required under the GDPR to verify the security and privacy compliance of any third party apps they send user data to? This really starts to cast doubt on the rest of the story for me; any app developer who hasn't been hiding under a rock since 2010 must know why modern companies insist on certifying third party apps with API access.

alaricus 4y ago
deleted 4y ago
[deleted]
bcrosby95 4y ago
If that were true, wouldn't Google have to verify the security and privacy compliance of every browser out there?
- SpicyLemonZest 4y ago
  I confess that I don't have a clear understanding of why browsers never seem to count in privacy discussions.
abofh 4y ago
The GDPR prohibits companies sharing customer data with third parties without consent of the customer. It most certainly does not prohibit customers disclosing their own data to third parties.
- contravariant 4y ago
  Also, if I run software then it's first party.

encryptluks2 4y ago

Respond how exactly? The last thing you want to do as an organization like this is to take action and then find out that the removal was warranted. I think it is up to the app developer to supply sufficient information to show that it was not warranted. In another posts, someone already showed where they are essentially uploading contacts to remote servers. I agree it sucks cause I had seen the app on F-Droid and it looks like it was actively developed, but the developer stopping development because of the Play Store removal doesn't help instill confidence. Otherwise, they'd just continue development and support F-Droid and alternative Play Store initiatives.

sreevisakh 4y ago
Why do the threads about FairMail contain so much misinformation? It wasn't uploading the contacts to any server. It was fetching favicons from the domains of each contact. That too was opt-in. It feels like there is an effort to discredit Fairmail here.
upofadown 4y ago
Some sort of competition related action would be the obvious answer. Google is using their market power to harass an alternative to their data collection funded services.
- encryptluks2 4y ago
  That is why it is called Play Store policies. You want to go after an anti-competitive company, at least target Apple first who won't even let you sideload apps.
  - Dylan16807 4y ago
    Nah we can do both.
Brian_K_White 4y ago
The developer is obligated to prove that they aren't guilty of something without being told what that thing is? Other people's detective work is just guessing. Google has not given any specific instructions, and so they cannot be followed. It IS on Google to be fair here. If the action is so hainous, then they can certainly say "this action is not allowed" so that the developer can satisfy them. List all the reasons why Google might not do that, and find a single one of them that's valid.

onphonenow 4y ago

The developer was scraping contact lists and using that to query third party servers. That is explicitly forbidden by google without permission from the user. He then repeatedly refused to fix the issue. They should perm-ban folks like this who don't take user privacy concerns seriously. Separately, it looks like he is using unsupported API calls potentially which are going to cause crashing problems - that may be a factor in their eval. Having dealt with situations where user error / issues were 99 to 1 the source of problems, the majority for just a failure to read the instructions, whoever has to deal with this stuff on the google side has got to be annoyed at both these app devs and their social media followings.

Ruthalas 4y ago
Can you provide a source for the contact list scraping? I currently use FairEmail, so that's a concern for me, but I'd not heard that it was happening in this conversation so far.
- Semaphor 4y ago
  This has some details and a code link: https://news.ycombinator.com/item?id=31434975 https://news.ycombinator.com/item?id=31434975
  - Ruthalas 4y ago
    Thank you!
- g_p 4y ago
  It seems like this was an opt-in feature, that was off by default, that allowed users to have a domain's favicon shown alongside the message. It doesn't seem like any contact info was sent. Indeed, if you go to the effort of turning on favicon showing, it also seems pretty obvious and intuitive the app will retrieve the favicon. And the way it's done here seems to be more privacy preserving than having a central server do this (and see what you request). This feels a bit to me like Google saying "web browser leaks details of your requests to a third party" - alarming, until you realise the third party is the DNS server, and that's how the internet works.

dang 4y ago

Related ongoing thread: FairEmail stopping development after Google falsely flags app as spyware - https://news.ycombinator.com/item?id=31432334 https://news.ycombinator.com/item?id=31432334 - May 2022 (238 comments)

vfclists 4y ago

Common sense says the developer is giving up because it is not worth it, ie not enough people buy the software or donate to support its development. Android users it is time you forked out more to support free software developers.