4 ms·

Permissions from Aurora Store (3rd party to Play Store): Hayya: - control vibration - have full network access - prevent phone from sleeping - run at start

Permissions from Aurora Store (3rd party to Play Store): Hayya: - control vibration - have full network access - prevent phone from sleeping - run at startup - run foreground service - view Wi-Fi connections - view network connections - access sensor data at a high sampling rate - access approximate location only in the foreground - access precise location only the foreground - listen to C2DM messages Etheraz: - access bluetooth settings - control vibration - disable your screen lock - have full network access - pair with bluetooth devices - prevent phone from sleeping - run at startup - run foreground service - this app can appear on top of other apps - view Wi-Fi connections - view network connections - access approximate location only in the foreground - access precise location only the foreground - directly call phone numbers I don't think these are really that extraordinary, but some are not obvious to me at least. Especially "listen to C2DM" seems odd, possibly a side effect of another permission. Of course with these permissions you can track and trace most of your life, but that is now the norm unfortunately. > In particular, the covid-19 app Ehteraz asks for access to several rights on your mobile., like access to read, delete or change all content on the phone, as well as access to connect to WiFi and Bluetooth, override other apps and prevent the phone from switching off to sleep mode. The statement about delete/change all content on the phone seems false tho. Also it doesn't "override other apps" whatever that should mean, but can draw over other apps. edit:fix formatting

flutas 4y ago
"listen to C2DM" is for push notifications iirc
- AnonCoward42 4y ago
  C2DM was shutdown in 2015 (https://developers.google.com/android/c2dm/ https://developers.google.com/android/c2dm/)
  - SpaghettiX 4y ago
    This name (and GCM, google cloud messaging) still lingers inside packages and error messages when only Firebase Cloud Messaging (FCM) now exist.
nottorp 4y ago
I'm guessing they used some framework and the libraries they used ask for a broad set of permissions because they offer access to their functions. But they're not necessarily used. Also considering they're asking for a permission for a protocol that was shut down 7 years ago, the framework must be quite old. Android permissions were less granular back then. I know someone in Germany and their covid tracking app tells you when and where you were close to someone who was last tested positive. So everyone does it the same way, recording location.
- sofixa 4y ago
  > I know someone in Germany and their covid tracking app tells you when and where you were close to someone who was last tested positive. So everyone does it the same way, recording location. Not sure about Germany, but in France the app doesn't track location. It tracks nearby devices (with Bluetooth, rotating identifiers frequently), and when one marks oneself as positive, it informs the central server of the identifiers used in the last X days, which then other apps checks against their list of known identifiers that were close. So there is no recording of location.
  - nottorp 4y ago
    My friend was definitely told where he was on the last contact. Doesn't mean his location left the phone though. [He didn't get Covid this time, but off topic for this discussion.] Edit: or maybe it's on topic because the location was at some amusement park outdoors. Since he knew where and it was relatively safe, he didn't have to worry much about the test results...
    - Tomte 4y ago
      No, definitely not. There is no location info anywhere in the app, and never has been. Obviously you can enter "library visit" in your contact diary manually, but even then there is no location involved, it's just a string of characters.
    - nkmnz 4y ago
      There isn't even a specific point in time given, only the day.
truemotive 4y ago
“access sensor data at a high sampling rate“ If that isn’t some terminator shit right there, I don’t know what is.
- Ekaros 4y ago
  Would it even be useful to access data like gyro, accelerometer, compass or proximity sensor at low rate useful? And what really is high sampling rate?
- nl 4y ago
  > If that isn’t some terminator shit right there, I don’t know what is. This seems an odd statement. You access sensor data at a higher rate for doing things like sports apps (eg, Strava) or many other scenarios. It's behind a permission at least partially because of the potential impact on battery life. It can be an incremental decrease in privacy (although not especially concerning if the app already has low sample speed access) but it is unclear why this is some kind of terminator issue.
iudqnolq 4y ago
> Also it doesn't "override other apps" whatever that should mean, but can draw over other apps. It's a permission designed for accessibility. Because it's so intrusive you usually have to go through a more complex flow to enable it. "override other apps" is a defensible colloquial definition because it enables clickjacking. Clickjacking is when you overlay an opaque, innocuous overlay and then open something you maliciously want to trick the user into clicking behind it.
squarefoot 4y ago
I wonder if any of those permissions could be used to give the app access to raw touch screen data. In theory only system drivers should be able to. If possible, it would pose a huge security risk: raw touch screen data reveal where the user taps before the data is sent to any security layer, so that by simply matching the coordinates to the known shape of the virtual keyboard, a malicious app would easily find text, including all passwords.
- lupire 4y ago
  No, they can't, for the reason you explained.
ASalazarMX 4y ago
Permissions analysis of Etheraz from Exodus, for comparison: https://reports.exodus-privacy.eu.org/en/reports/com.moi.covid19/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.moi.cov... 1 TRACKER - AltBeacon 19 PERMISSIONS - ACCESS_BACKGROUND_LOCATION - ACCESS_COARSE_LOCATION - ACCESS_FINE_LOCATION - ACCESS_NETWORK_STATE - ACCESS_WIFI_STATE - BLUETOOTH - BLUETOOTH_ADMIN - CALL_PHONE - DISABLE_KEYGUARD - FOREGROUND_SERVICE - INTERNET - QUICKBOOT_POWERON - RECEIVE_BOOT_COMPLETED - SYSTEM_ALERT_WINDOW - VIBRATE - WAKE_LOCK - BIND_GET_INSTALL_REFERRER_SERVICE - GET_COMMON_DATA

flutas 4y ago

"listen to C2DM" is for push notifications iirc

AnonCoward42 4y ago
C2DM was shutdown in 2015 (https://developers.google.com/android/c2dm/ https://developers.google.com/android/c2dm/)
- SpaghettiX 4y ago
  This name (and GCM, google cloud messaging) still lingers inside packages and error messages when only Firebase Cloud Messaging (FCM) now exist.

nottorp 4y ago

I'm guessing they used some framework and the libraries they used ask for a broad set of permissions because they offer access to their functions. But they're not necessarily used. Also considering they're asking for a permission for a protocol that was shut down 7 years ago, the framework must be quite old. Android permissions were less granular back then. I know someone in Germany and their covid tracking app tells you when and where you were close to someone who was last tested positive. So everyone does it the same way, recording location.

sofixa 4y ago
> I know someone in Germany and their covid tracking app tells you when and where you were close to someone who was last tested positive. So everyone does it the same way, recording location. Not sure about Germany, but in France the app doesn't track location. It tracks nearby devices (with Bluetooth, rotating identifiers frequently), and when one marks oneself as positive, it informs the central server of the identifiers used in the last X days, which then other apps checks against their list of known identifiers that were close. So there is no recording of location.
- nottorp 4y ago
  My friend was definitely told where he was on the last contact. Doesn't mean his location left the phone though. [He didn't get Covid this time, but off topic for this discussion.] Edit: or maybe it's on topic because the location was at some amusement park outdoors. Since he knew where and it was relatively safe, he didn't have to worry much about the test results...
  - Tomte 4y ago
    No, definitely not. There is no location info anywhere in the app, and never has been. Obviously you can enter "library visit" in your contact diary manually, but even then there is no location involved, it's just a string of characters.
  - nkmnz 4y ago
    There isn't even a specific point in time given, only the day.

truemotive 4y ago

“access sensor data at a high sampling rate“ If that isn’t some terminator shit right there, I don’t know what is.

Ekaros 4y ago
Would it even be useful to access data like gyro, accelerometer, compass or proximity sensor at low rate useful? And what really is high sampling rate?
nl 4y ago
> If that isn’t some terminator shit right there, I don’t know what is. This seems an odd statement. You access sensor data at a higher rate for doing things like sports apps (eg, Strava) or many other scenarios. It's behind a permission at least partially because of the potential impact on battery life. It can be an incremental decrease in privacy (although not especially concerning if the app already has low sample speed access) but it is unclear why this is some kind of terminator issue.

iudqnolq 4y ago

> Also it doesn't "override other apps" whatever that should mean, but can draw over other apps. It's a permission designed for accessibility. Because it's so intrusive you usually have to go through a more complex flow to enable it. "override other apps" is a defensible colloquial definition because it enables clickjacking. Clickjacking is when you overlay an opaque, innocuous overlay and then open something you maliciously want to trick the user into clicking behind it.

squarefoot 4y ago

I wonder if any of those permissions could be used to give the app access to raw touch screen data. In theory only system drivers should be able to. If possible, it would pose a huge security risk: raw touch screen data reveal where the user taps before the data is sent to any security layer, so that by simply matching the coordinates to the known shape of the virtual keyboard, a malicious app would easily find text, including all passwords.

lupire 4y ago
No, they can't, for the reason you explained.

ASalazarMX 4y ago

Permissions analysis of Etheraz from Exodus, for comparison: https://reports.exodus-privacy.eu.org/en/reports/com.moi.covid19/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.moi.cov... 1 TRACKER - AltBeacon 19 PERMISSIONS - ACCESS_BACKGROUND_LOCATION - ACCESS_COARSE_LOCATION - ACCESS_FINE_LOCATION - ACCESS_NETWORK_STATE - ACCESS_WIFI_STATE - BLUETOOTH - BLUETOOTH_ADMIN - CALL_PHONE - DISABLE_KEYGUARD - FOREGROUND_SERVICE - INTERNET - QUICKBOOT_POWERON - RECEIVE_BOOT_COMPLETED - SYSTEM_ALERT_WINDOW - VIBRATE - WAKE_LOCK - BIND_GET_INSTALL_REFERRER_SERVICE - GET_COMMON_DATA