Comment by wallflower | Hacker News Reader

Comment by wallflower | Hacker News Reader

I don't care that much about the GPS function since that is usually sent over 3G/4G (which in theory is harder to sniff).

But the apps that request access to your Contacts? I wanted to install an application recently (some recipe thing that had good UX) but it requested READ_CONTACTS. So I balked and didn't install it.

Why did a recipe app need access to my Contacts? To be fair, all of your iOS Contacts are wide-open to any SDK app (they never bothered to lock it down like GPS).

I think the real solution is something like LittleSnitch for Droid. It would have to be installed as a Root process though on a rooted phone.

http://developer.android.com/reference/android/Manifest.perm...

On the contacts thing, this is probably needed for the "send this thing to a friend" functionality, so the app can pull email addresses out of the contacts db.

When an app wants contacts permissions when it doesnt have an obvious reason, this is usually it.

In their case, it sounds like GPS was sent over wifi by the apps.

But the bigger thing is regarding why those apps need GPS coordinates. Much like a recipe app needing contacts, and app that doesn't need to know my location shouldn't be transmitting it.

In the comments attached to that post the creator of ShopSavvy pointed out that it is a local shopping app, that by design needs to know your location - that's kind of the point of the app.

The reply was that he'd prefer to have options about the degree of accuracy given to the app.

While I can see that argument, at the current point in time I think ShopSavvy is doing the correct thing by it's users (ie, simplifying things, and removing unnecessary options)

It wouldn't matter if GPS info went out over wifi rather than 3G/4G. If you're close enough to sniff wifi then you are probably close enough to have some idea where in the world they are.

There is something like LittleSnitch for Android. It's called TaintDroid, but unfortunately it requires that a custom firmware be installed:

http://www.appanalysis.org/

Reply on news.ycombinator.com