3 ms·

> Of course I expect to find a privacy policy. If the app store allowed you to specific in app metadata that no data leaves the device, and that was enforced b

> Of course I expect to find a privacy policy. If the app store allowed you to specific in app metadata that no data leaves the device, and that was enforced by device policy, I wouldn't expect a privacy policy.

kccqzy 2y ago
"No data leaves the device" is such a vague policy that it means nothing. At a minimum, your app displays some UI containing its data. Bravo, information from the app now leaves the device through the photons emitted by the screen. Same for speakers. Now consider the clipboard. The user copies some text from your app and pastes it into an online forum. Bravo, information from the app now leaves the device through the clipboard.
GuB-42 2y ago
Device policies are actually harder than it may seem (to enforce that no data leaves the device). Here is a comment by a Google employee. It is about the internet access permission, but this part illustrates that side channels exist. > Requests to be able to remove internet access are almost always really requests to “make sure this app can’t get any data off the device.” However, just removing this permission does not actually give that guarantee; there are numerous side-channels apps can use to still get data off the device. An obvious one is to launch the web browser with a URL for their web site, which has stashed in it a bunch of data they want to exfiltrate. And there are many others. It is really hard to actually give a guarantee that no data can be exfiltrated, while still giving enough capability for most apps to be functional. Source: https://old.reddit.com/r/androiddev/comments/ci4tdq/were_on_the_engineering_team_for_android_q_ask_us/evq6qww/ https://old.reddit.com/r/androiddev/comments/ci4tdq/were_on_...
- Marsymars 2y ago
  Right, but if an app agrees not to exfiltrate data via the app submission process, and then proceeds to do so, it's basically the same as the app having a privacy policy and then not adhering to it. If an explicit "privacy policy" is required (for legal reasons or w/e), when an app submits "no data to be exfiltrated", the app store could say "here is the privacy policy you're agreeing to follow, no further action required".
  - GuB-42 2y ago
    I don't know the Play Store app submission process, but if it isn't the case, it would be nice to have a bunch of pre-written privacy policies for common cases. Ideally hosted by Google, vetted by lawyers and explained in simple terms to both users and developers. And "we don't store any data" would be an obvious one, as well as those that use Google services exclusively (ads, ...). That would make it easier for everyone.
    - Marsymars 2y ago
      Agreed, that would be good. Someone at Apple/Google should take a note.
- o11c 2y ago
  > An obvious one is to launch the web browser with a URL for their web site, which has stashed in it a bunch of data they want to exfiltrate. I mean ... just don't allow that, except for a finite whitelisted set of URLs that require explicit user intervention to access (to prevent exfiltration via timing/ordering)? It's not difficult to make a rule that apps can easily follow, it's just that none of the parties involved actually care about the user.

kccqzy 2y ago

"No data leaves the device" is such a vague policy that it means nothing. At a minimum, your app displays some UI containing its data. Bravo, information from the app now leaves the device through the photons emitted by the screen. Same for speakers. Now consider the clipboard. The user copies some text from your app and pastes it into an online forum. Bravo, information from the app now leaves the device through the clipboard.

GuB-42 2y ago

Device policies are actually harder than it may seem (to enforce that no data leaves the device). Here is a comment by a Google employee. It is about the internet access permission, but this part illustrates that side channels exist. > Requests to be able to remove internet access are almost always really requests to “make sure this app can’t get any data off the device.” However, just removing this permission does not actually give that guarantee; there are numerous side-channels apps can use to still get data off the device. An obvious one is to launch the web browser with a URL for their web site, which has stashed in it a bunch of data they want to exfiltrate. And there are many others. It is really hard to actually give a guarantee that no data can be exfiltrated, while still giving enough capability for most apps to be functional. Source: https://old.reddit.com/r/androiddev/comments/ci4tdq/were_on_the_engineering_team_for_android_q_ask_us/evq6qww/ https://old.reddit.com/r/androiddev/comments/ci4tdq/were_on_...

Marsymars 2y ago
Right, but if an app agrees not to exfiltrate data via the app submission process, and then proceeds to do so, it's basically the same as the app having a privacy policy and then not adhering to it. If an explicit "privacy policy" is required (for legal reasons or w/e), when an app submits "no data to be exfiltrated", the app store could say "here is the privacy policy you're agreeing to follow, no further action required".
- GuB-42 2y ago
  I don't know the Play Store app submission process, but if it isn't the case, it would be nice to have a bunch of pre-written privacy policies for common cases. Ideally hosted by Google, vetted by lawyers and explained in simple terms to both users and developers. And "we don't store any data" would be an obvious one, as well as those that use Google services exclusively (ads, ...). That would make it easier for everyone.
  - Marsymars 2y ago
    Agreed, that would be good. Someone at Apple/Google should take a note.
o11c 2y ago
> An obvious one is to launch the web browser with a URL for their web site, which has stashed in it a bunch of data they want to exfiltrate. I mean ... just don't allow that, except for a finite whitelisted set of URLs that require explicit user intervention to access (to prevent exfiltration via timing/ordering)? It's not difficult to make a rule that apps can easily follow, it's just that none of the parties involved actually care about the user.