Comment by kenoph | Hacker News Reader

Comment by kenoph | Hacker News Reader

I did my Master Thesis on this kind of stuff. There are many Apps among the top 100 free ones that ask permissions completely unrelated to their functionality. Yeah I know, not surprising. What surprised me at the time was that Android gives away much information "for free". For example, if I recall correctly, GET_ACCOUNTS was granted automatically and it allowed to get the "title" of every account on the phone as shown in the Android UI. Most Apps use the actual username as the title, google included (aka, every App could read your email address). Nice exceptions are Signal and WhatsApp.

I'm the author of this article and I'd love to learn more about what you found in your research. You can reach me at craig dot silverman at buzzfeed.com.

This review from USENIX Enigma 2019 might be interesting for you. They tested over 80,000 of the most popular Android apps to examine what data they access and with whom they share it, how mobile apps are tracking and profiling users, how these practices are often against users' expectations and public disclosures, and how app developers may be violating various privacy regulations.

Some numbers from the presentation

  - the "GPS icon" is visible for only 0.04% of actual accesses to location data

  - of 42000 apps transmitting personal information, 21000 (50%) don't use TLS and send data unencrypted

  - 1,325 apps that don't have location permission, actually obtain street-level location data and transmit it home

https://www.usenix.org/conference/enigma2019/presentation/eg...

Thanks!

Reply on news.ycombinator.com