Comment by wartijn_ | Hacker News Reader

Comment by wartijn_ | Hacker News Reader

Parent Full thread

From the article:

> The 1,325 apps that violated permissions on Android used workarounds hidden in its code that would take personal data from sources like Wi-Fi connections and metadata stored in photos.

> Researchers found that Shutterfly, a photo-editing app, had been gathering GPS coordinates from photos and sending that data to its own servers, even when users declined to give the app permission to access location data.

> Some apps were relying on other apps that were granted permission to look at personal data, piggybacking off their access to gather phone identifiers like your IMEI number. These apps would read through unprotected files on a device's SD card and harvest data they didn't have permission to access. So if you let other apps access personal data, and they stored it in a folder on the SD card, these spying apps would be able to take that information.

So basically, they can't read your location, but they can read other things that contain your (previous) location and other information about you.

Edit: The article links to the original research[0], which seems to describe/link to different methods that the apps use. I haven't had time to read it yet, but it seems interesting.

[0] https://www.ftc.gov/system/files/documents/public_events/141...

> Researchers found that Shutterfly, a photo-editing app, had been gathering GPS coordinates from photos and sending that data to its own servers, even when users declined to give the app permission to access location data.

One of the first things I disable when I have a new phone is geolocation being added to photos. I just don't want my location randomly being shared from an image without my consent. If I wanted you to know where I took the picture, I would tell you.

> If I wanted you to know where I took the picture, I would tell you.

That's really missing the major use case, though, isn't it? I like having it enabled so my phone will tell me where I took the picture, because there's little chance I'll be able to a year later.

It'd be nice if the "access photos" API on the device would have a separate permission for EXIF data. Without it, the app would receive only the image itself, not the attached metadata - kinda like how Facebook strips off any EXIF data when you publish a photo there.

I think that's what Google Photos do when you share (at least by link). Would be nice if photos accessed on Android had their location stripped, if the app doesn't have location access.

That still leaves google collecting your location info from the EXIF data just as I assume facebook collects your as it is stripped out. Google doesn't need to know the exact date, time, and location every photo I take was taken either.

If Google's part of your threat model, it's probably time to ditch the Android phone entirely. No amount of permissions is really going to matter.

google should be part of everyone's threat model, but while we're forced to live with google and forced to hand over some data, it's best to limit what we send them voluntarily whenever we have any option.

Google and Apple are both part of my threat model. So I use an old dumbphone. It doesn't even text.

This is actually the change coming to Android Q - OS will strip out location data from photos when apps access them. EXIF will require extra permissions.

That's awesome. I have EXIF-stripping apps which I use to remove location data before uploading them in other apps, but for all I know the EXIF-stripping apps are harvesting the location data themselves...

https://f-droid.org/en/packages/com.jarsilio.android.scrambl...

It should be disabled by default, data that doesn't exist is data that can't stolen. Most people are also surprised that an image contains GPS co-ordinates and do not consider that something as simple as sharing a photo on the internet is giving away there home address.

This particular issue should be fixed by Android Q's new "scoped storage" permission model: https://developer.android.com/preview/privacy/scoped-storage...

Looks like apps can opt out via an api call, so it's not really a security measure.

That's only for the beta build of Android Q. It won't work in the production release.

> So basically, they can't read your location, but they can read other things that contain your (previous) location

Yes, and I think we could make a good case that the Android platform did a poor job of clarifying this to the user. I would guess that the typical android user thinks "location permission" means location data of any type as generated by any subsystem on the device.

To whom would a reasonable user assign responsibility for this protection failure -- app developers or the Android platform?

I mean, as much as I'd like to give Android crud here, I think this is incredibly unethical developer behavior, and it's kind of incredible to see we still have so many people in the industry who think scraping location data out of people's stored photos for advertising data is okay. It's well outside the realm of something I'd think someone would even try to do, especially from a pretty legitimate company like Shutterfly.

> I mean, as much as I'd like to give Android crud here, I think this is incredibly unethical developer behavior ….

Right, but "our system will protect you from ethical developers!" isn't much of a security model, so I think there's still plenty of blame for Android here.

What exactly is the blame of Android? That it allows the app to read photos when user allows it to read photo files?

Because this criminal behaviour is also present in Linux, Windows and macOS.

Or the fact that an app can write a file to disk? And then another app can open the file? Also criminal behaviour present in other operating systems. Some users might even call it a feature and do the unthinkable - share files between applications! Horrible!

Seriously, you're blaming the OS because it allows you to run useful software on it, just like a desktop computer. If you want a jailed down device, it's fine: buy Apple. But that doesn't mean every pocket computer needs to be a crippled device.

I would not consider my iPhone to be a crippled device.

Just because these issues exist on a traditional computing device, does not mean we should continue that trend when a new type of platform exists (mobile).

Plus, many of us likely have much more personal data on our phones that we ever had on our computers, especially location data for where you are all the time.

This is absolutely a failure of the OS, but if you choose to accept that fine. But the issue is for those that are not in the tech community and don't realize there data is being mined when they specially chose the option to deny it.

I expect my devices to uphold the security model they advertise.

My desktop OS (macOS, for what it matters) doesn't ask me to approve permissions for apps, so I assume that anything I install has whatever privileges I have (or root privileges, given the broken must-install-as-root behaviour of many of them).

On the other hand, for example, Firefox asks my permission before allowing sites to use the microphone or camera, and I expect it to enforce that. If sites can get access to my microphone or camera without my giving them permission, then Firefox has failed, even if those sites have got that access through unexpected means.

I agree it's very hard to have a secure but useable general-purpose system—but pretending that you're offering such a system while not actually having the appropriate mechanisms to enforce it is, arguably, an even worse solution than offering an utterly locked-down system.

Here's a simple experiment. On a Linux box, open your GUI text editor. Try to open /var/log/syslog. You will see "Permission denied". That's because only apps with root can access /var/*.

I agree that's a simple experiment. What does it demonstrate?

You said this:

> I assume that anything I install has whatever privileges I have (or root privileges, given the broken must-install-as-root behaviour of many of them).

My point is that Linux apps don't have general root rights. Even though you must install them as root. That is, unless you start them as root. So an app can't just decide to access and change some other app's settings.

> My point is that Linux apps don't have general root rights. Even though you must install them as root. That is, unless you start them as root.

I'm running macOS, so this isn't directly relevant; I don't know much about Linux apps, but macOS ones often do some skulduggery—for example, Dropbox uses its root installation privileges to make some very hard-to-eradicate startup items (https://applehelpwriter.com/2016/08/29/discovering-how-dropb...). Nonetheless, you are right that I was confusing "installed as root" with "has root privileges".

> So an app can't just decide to access and change some other app's settings.

Hopefully!—at least if this happens it's a bug.

Just as an added point for my claim that this position is not hypocritical, I consider https://news.ycombinator.com/item?id=20387298 to be a flaw in the macOS security model, for which the OS deserves blame, and not just an instance of poor app design (although it is clearly that).

What exactly is the blame of Android? That it allows the app to read photos when user allows it to read photo files?

On iOS, you have to separately allow image access and access to location data stored as part of the image.

> Seriously, you're blaming the OS because it allows you to run useful software on it, just like a desktop computer.

Unlike a desktop computer Android prevents you from taking steps to protect yourself. Without rooting your phone you can't even install firewalls or prevent applications from ever connecting to the outside world. Google designed their OS to collect and leak your data. It's why their permissions system (even when working as designed) is garbage. Google doesn't want you to have the ability to protect yourself. It assumes responsibility and lets you (sometimes) disable some permissions from some apps (but not others) at their discretion. No one does that on my desktop computers. Most people's phones are filled with apps they don't want but aren't even allowed to uninstall.

> Without rooting your phone you can't even install firewalls or prevent applications from ever connecting to the outside world.

Of course you can. There are multiple apps that do this. One example: https://f-droid.org/en/packages/eu.faircode.netguard/

It looks like netguard is a VPN service, not a true firewall. A firewall on my desktop doesn't require me to route all my traffic through a VPN. Netguard also injects ads in your traffic (or at least did) https://imgur.com/a/2YG7Q

Nope. It runs solely on the device. How else would it know which app is making the network request? What are you basing your strange claims on?

> Netguard also injects ads in your traffic (or at least did) https://imgur.com/a/2YG7Q

Netguard is open source (with a license not supported on iOS: https://github.com/M66B/NetGuard), so there is no reason to use a build that shows ads. Alternatively, as I said earlier, there are multiple firewall apps you could use that don't require root.

From their own FAQ:

> NetGuard will do its best, but it is limited by the fact it must use the VPN service.

FAQ: https://github.com/M66B/NetGuard/blob/master/FAQ.md

See also: https://www.reddit.com/r/Android/comments/4uhl3w/netguard_ad...

VPNService is an API (https://developer.android.com/reference/android/net/VpnServi...). Your own link points tp this documentation. It does not require sending your data to a VPN, and in this case, it obviously doesn't.

The weird thing is that you went out of your way to research to find a misleading quote when the page itself points out why the quote is misleading and that the app is open source (negating your ads claim earlier).

It has to route traffic through a local VPN to drop the traffic. Doesn't play well with other VPNs for this reason. Real firewalls need root. The VPN trick is a hack to get around that while still providing some of that functionality. Yes, you could edit the source code and compile it yourself every time it updates to remove the ads, but I think that's a little much to expect.

Ultimately this is functionality users should have access to by default without needing to resort to hacks and ad-filled workarounds.

> Real firewalls need root.

Real computers let you install trusted stuff that has root.

> Doesn't play well with other VPNs for this reason. Real firewalls need root.

"Real firewalls" also don't play well with other VPNs. I don't see what functionality you think you're missing here.

> Yes, you could edit the source code and compile it yourself every time it updates to remove the ads, but I think that's a little much to expect.

Nobody's suggesting that. Just install another build (like the one I posted on F-droid) or any number of other apps that do the same thing.

> Ultimately this is functionality users should have access to by default

No OS comes with this functionality by default, only the APIs to implement it, exactly like Android.

Android: without rooting your phone, I keep writing this on HN :) it is called "NoRoot Firewall". Free app, it creates a VPN within your phone and asks you for every ip:port to allow/block and one can also use rules such as Block 111.111.., port: 123. Worth checking out. I have e.g. a chess app, I keep it block all IPs/Ports. I never have to worry for tracking, spying, ads, etc.

Yes Android is to blame. The entire idea behind a sandboxed mobile OS is that random developers can’t be trusted not to invade your privacy.

But honestly neither can Google, but that’s another story...

If you upload a picture to Shutterfly, that is a user specifically putting the photo in the app's sandbox. The same thing happens on every other OS.

Not with iOS. There is a separate media library API that’s separate from the file access API. You can give an app permission to access your media library without giving it access to the location metadata. The app has to specifically ask for location access to get the metadata.

> The app has to specifically ask for location access to get the metadata.

Source? https://apple.stackexchange.com/questions/335809/can-ios-app... disagrees with your claim.

> You can give an app permission to access your media library without giving it access to the location metadata. The app has to specifically ask for location access to get the metadata

I believe this used to be true, but it's not anymore. I just tested it and even without location permissions, the location EXIF is included

Does iOS do anything to prevent this?

Yes, iOS prevents you from directly accessing the images and apps sharing files between themselves.

Which has been one of the major reasons some people used Android - the ability to use their phone more like a computer.

No, iOS prevents the application from directly accessing files without the user’s permission. The user can choose to allow access granularly to a file via the file picker within the app.

There are also separate permissions to allow apps to read and write from the media library.

Reply on news.ycombinator.com