4 ms·
There are at least some checks in place. I was filling it out for an app that I work on, and forgot about a feature where we shared a GPS location with an API t
by elliotmurray 4y ago
There are at least some checks in place. I was filling it out for an app that I work on, and forgot about a feature where we shared a GPS location with an API to get a street address. I checked the box to say that the users GPS position never leaves the phone and I pretty much instantly got an email saying that the app was rejected and to fill out the form again.
- yjftsjthsd-h 4y agoThat's good to hear, but how do they tell? I mean, following a GPS API call through to something that talks over the network seems like the kind of thing that would be a decent amount of work even with the source code; am I underestimating the state of modern analysis on binaries?
- awinter-py 4y agoagree, but also this is where tech needs to get if we want to have private experiences + actual control over downloaded binaries (could also do dataflow analysis on code in a trusted third party CI system)
- awinter-py 4y agoah I bet this is google detecting an SDK, not doing deeper code analysis to detect exfiltration of GPS data they did this with the huq sdk https://www.vice.com/en/article/y3vp35/google-tells-apps-disclose-location-data-removed-huq https://www.vice.com/en/article/y3vp35/google-tells-apps-dis...