Hacker News Reader

Comment by kimi | Hacker News Reader

It may be just me, but every time I download an app I have a feeling that I'm signing in into something that will do whatever it wants on my phone - geolocation, read address book, access the internet? for what?

And then, you know, there are these things called "websites" that you access using a single app called "browser" that end up being pretty useful even on your phone.

View on HN

This is exactly why I don't download apps. I proxied my phone one day and almost fell out of my chair. I'm shocked Google and Apple allow this to go on.

What was the most unexpected thing you found?

I was under the impression that mitmproxy is no longer effective with iOS's mandatory pinned certificates. How did you manage to intercept traffic?

iOS' App Transport Security is friendly to researchers that install their own CA.

Android Nougat is much worse in this regard: Apps disrespect any user-added CAs, which really doesn't contribute to Android's security level but makes checking what your apps send home a huge PITA.

Pretty sure that's how most app conception begins. How can they gather as much user data as possible, or as many videos micropayments as possible.

I think that most apps only exist so that some company can get a tracking device onto your phone.

Permission systems are fairly good in both Android and iOS now, though.

Note: I agree that protecting your data is important, I don't want to downplay that.

No, the situation is "take it or leave it". Give all the permissions, or don't get to use the app. There are now even web sites (facebook, google maps, yahoo email) that seem to refuse service if you are determined to be on a phone. They demand that you install their app instead.

Proper permissions would have 4 possible settings:

1. ask (the default), with checkbox to make the choice stick

2. deny

3. allow

4. deceive the app, pretending to allow.

That last one is important. It keeps apps from forcing users to allow absurd permissions. Deception plug-ins should be possible, allowing various kinds of deception (like "oh, sorry, there is no signal") and even man-in-the-middle against the apps.

The problem is not that permissions are pretty good. The problem is that you have to give many apps way too many permissions to work.

Let's make an example; I use the FitBit tracker and quite like it. I also use its own Android app. A few months ago, they decided that in order to sync you need to enable GPS. Now, there is no reason on Earth why I need to turn on GPS to download data from my watch and upload it to FitBit's server. Still, no permission or GPS disabled = no sync.

Frankly, I do not think this is in my best interest. And I wonder how many of their user-base noticed the change of permissions.

I'm writing an article about this, doing research now, trying to correlate battery usage on a device with how many apps are installed on it, and user use.

If the user isn't using the device, and the more apps on it, the faster the battery drains, it's transmitting something somewhere to someone...

Your claim is that random 3rd party apps are transmitting unknown data while the apps are closed and the phone is not in use?

You are, at least, thinking about it. Way ahead of the game.

Most phone users have no reason to download apps, and most app publishers are clueless about providing a reason, or even awareness their apps exist, beyond uploading them and hoping.

The nature of apps skews these numbers. So few apps are either worthy of a user's time, or awareness, that these low averages are not informative about apps that are worthy. It's more obvious for Web sites. Your blog is outdated, unmaintained, and obscure. So it gets no hits. Nobody is surprised. But that says nothing about Web sites that do contend for user awareness. Same for apps.

An iOS app can't access anything significantly different than a website can, unless you give it permissions to.

I can't speak for iOS but many Android apps I've used always ask for crazy permissions and then refuse to work unless I say yes.

My biggest fear, as silly as this may sound, is an app that wants my phone book will contact the people in that phone book for some reason. For example, to tell them that I'm a possible person to add to their Derpchat friends list. My phone book is a useless listing of past professional, personal, and educational contacts whom I don't have a relationship with anymore. I have no idea how it gets auto filled with 99% people I don't want in there but I just don't trust it. I'm afraid I'll accidentally ping someone from my past.

So delete your contacts, and keep them in something else such as a simple document.

Reply on news.ycombinator.com