4 ms·

PrivacyGrade: Grading the Privacy of Smartphone Apps

26 points by guardian5x 12y ago

dobbsbob 12y ago
How did WhatsApp receive an A rating when it can access your mic and camera to record without confirmation?
- codesuela 12y ago
  they actually just rate whether the App permissions match the users expectations.
- hobarrera 12y ago
  Because users expect an application used for sending audio snippets use the microphone.
- cryptolect 12y ago
  Considering the functionality that wasn't reviewed, I don't think it should be advertised as "A". It might be "A" for the expected permissions, but if there's extra permissions which haven't been investigated, these should be marked down until explained. This would encourage app owners to work with whoever maintains the database to get accurate ratings. If Whatsapp is an A today, there's no incentive for the developers to justify / assist with anything unexplained permissions remaining. In it's current state, if it's awarding A scores while significant permissions are unexplained, it doesn't help the end user.
deleted 12y ago
[deleted]
mediaserf 12y ago
Facebook gets an A? All the egregious permissions say "Not analyzed yet". In cases where permissions aren't analyzed the grade should at least be marked as tentative / incomplete.
- Eye_of_Mordor 12y ago
  If trust is earned then they should all be graded 'D' until shown otherwise.
Kapow2112 12y ago
I think this just highlights a problem with app permissions. Why should the Kindle app ( http://privacygrade.org/apps/com.amazon.kindle.html http://privacygrade.org/apps/com.amazon.kindle.html ) require phone status and identity? (Also how is "not analyzed yet" helpful?)
- Kapow2112 12y ago
  Even worse, why can Skype ( http://privacygrade.org/apps/com.skype.raider.html http://privacygrade.org/apps/com.skype.raider.html ) read my text messages when I definitely never want to use the feature?
Eye_of_Mordor 12y ago
Anything that can read my contacts should automatically be a 'D' in my opinion. Take pictures and access the internet - that's a 'D' too. I know this site is measuring the difference to people's expectations, but privacy needs to be re-framed once you have an out of control government in the mix.
- jmnicolas 12y ago
  Given your username I find it a bit ironic that you're talking about "an out of control government" :-)
Brakenshire 12y ago
Seems to be based on 'does this app have an apparently plausible reason for requesting the permission?' but nothing beyond that. Some app might introduce some incidental feature that requires access to browsing history, that doesn't justify giving it that permission. Anyway, it's an impressive website, good to see new work being done in this area. Access to smartphone data is a wild west at the moment.
thrush 12y ago
Is this Android only?
AdmiralAsshat 12y ago
I don't see any information about how information is communicated between my phone and the app's servers. To me, that's a pretty big privacy concern. If Pulse, for instance, is connected to my LinkedIn account, are my credentials for authenticating with the app being sent over plaintext? I suppose the above is more of a "security" concern than a "privacy" concern, but I think they are ultimately one and the same.

26 points by guardian5x 12y ago

dobbsbob 12y ago

How did WhatsApp receive an A rating when it can access your mic and camera to record without confirmation?

codesuela 12y ago
they actually just rate whether the App permissions match the users expectations.
hobarrera 12y ago
Because users expect an application used for sending audio snippets use the microphone.
cryptolect 12y ago
Considering the functionality that wasn't reviewed, I don't think it should be advertised as "A". It might be "A" for the expected permissions, but if there's extra permissions which haven't been investigated, these should be marked down until explained. This would encourage app owners to work with whoever maintains the database to get accurate ratings. If Whatsapp is an A today, there's no incentive for the developers to justify / assist with anything unexplained permissions remaining. In it's current state, if it's awarding A scores while significant permissions are unexplained, it doesn't help the end user.

deleted 12y ago

[deleted]

mediaserf 12y ago

Facebook gets an A? All the egregious permissions say "Not analyzed yet". In cases where permissions aren't analyzed the grade should at least be marked as tentative / incomplete.

Eye_of_Mordor 12y ago
If trust is earned then they should all be graded 'D' until shown otherwise.

Kapow2112 12y ago

I think this just highlights a problem with app permissions. Why should the Kindle app ( http://privacygrade.org/apps/com.amazon.kindle.html http://privacygrade.org/apps/com.amazon.kindle.html ) require phone status and identity? (Also how is "not analyzed yet" helpful?)

Kapow2112 12y ago
Even worse, why can Skype ( http://privacygrade.org/apps/com.skype.raider.html http://privacygrade.org/apps/com.skype.raider.html ) read my text messages when I definitely never want to use the feature?

Eye_of_Mordor 12y ago

Anything that can read my contacts should automatically be a 'D' in my opinion. Take pictures and access the internet - that's a 'D' too. I know this site is measuring the difference to people's expectations, but privacy needs to be re-framed once you have an out of control government in the mix.

jmnicolas 12y ago
Given your username I find it a bit ironic that you're talking about "an out of control government" :-)

Brakenshire 12y ago

Seems to be based on 'does this app have an apparently plausible reason for requesting the permission?' but nothing beyond that. Some app might introduce some incidental feature that requires access to browsing history, that doesn't justify giving it that permission. Anyway, it's an impressive website, good to see new work being done in this area. Access to smartphone data is a wild west at the moment.

thrush 12y ago

Is this Android only?

AdmiralAsshat 12y ago

I don't see any information about how information is communicated between my phone and the app's servers. To me, that's a pretty big privacy concern. If Pulse, for instance, is connected to my LinkedIn account, are my credentials for authenticating with the app being sent over plaintext? I suppose the above is more of a "security" concern than a "privacy" concern, but I think they are ultimately one and the same.