2 ms·

Pretty much everything that uses AMap does this - any popular Chinese-developed application with mapping functionality will exhibit the same behavior. I have t

by bri3d 3y ago

Pretty much everything that uses AMap does this - any popular Chinese-developed application with mapping functionality will exhibit the same behavior. I have trouble seeing this as being quite as sinister in motivation as it first appears; while this data is certainly invasive and valuable, it's the same data that Google and Apple collect to build their mapping services, as well. It's a tough problem. I think the Big Issue exposed by this car battery monitor is the lack of granularity in mobile OS permissions. By granting the Android app BLE access, you also give it "fine location" access which lets AMap slurp your data. I think this write-up is pretty good but I wish OP hadn't buried the lede as much in the first paragraphs. Why not mention it's AMap in the tl;dr summary?

haxrob 3y ago
Hey OP here - I mostly agree with your points in respect to AMap. It's a legitimate mapping service and location SDK. > Why not mention it's AMap in the tl;dr summary? The GPS data is being sent to two different companies - the battery monitor developer and AMap. I could make this clearer in the tl;dr. The cell phone tower data (MNC,MCC,LAC,Cell ID) and Wifi BSSID collection is AMap only. That said, none of the AMap behavior is disclosed by the application developer. Literally apps that use the AMap SDK in this way turns the user's handset into a continuous scanner. This impacts user experience - just check all the complaints on the 1.75k reviews on the Play store [1]. I doubt many devs are aware of this - It took me countless hours to figure the AMap side of things due to obfuscation techniques in the AMAp code. (See part 2 on the blog post series). The primary issue is that all this data is collected, sent to multiple 3rd parties (AMap being one of them) and none of this was disclosed to consumers when they download the applications. [1] https://play.google.com/store/apps/details?id=com.dc.battery.monitor2 https://play.google.com/store/apps/details?id=com.dc.battery...

by bri3d 3y ago

haxrob 3y ago

Hey OP here - I mostly agree with your points in respect to AMap. It's a legitimate mapping service and location SDK. > Why not mention it's AMap in the tl;dr summary? The GPS data is being sent to two different companies - the battery monitor developer and AMap. I could make this clearer in the tl;dr. The cell phone tower data (MNC,MCC,LAC,Cell ID) and Wifi BSSID collection is AMap only. That said, none of the AMap behavior is disclosed by the application developer. Literally apps that use the AMap SDK in this way turns the user's handset into a continuous scanner. This impacts user experience - just check all the complaints on the 1.75k reviews on the Play store [1]. I doubt many devs are aware of this - It took me countless hours to figure the AMap side of things due to obfuscation techniques in the AMAp code. (See part 2 on the blog post series). The primary issue is that all this data is collected, sent to multiple 3rd parties (AMap being one of them) and none of this was disclosed to consumers when they download the applications. [1] https://play.google.com/store/apps/details?id=com.dc.battery.monitor2 https://play.google.com/store/apps/details?id=com.dc.battery...