Hacker News Reader

Comment by ajross | Hacker News Reader

It's worth pointing out that the app seems genuinely to have been in violation of the Play Store Malware policy (see the "Spyware" section at https://support.google.com/googleplay/android-developer/answ...)

The nature of email clients, especially ones that integrate with cloud-hosted spam and filtering services, is that they're naturally going to have trouble with that policy absent great care with specifying exactly what gets collected. The "fix" here seems to have been to update their policy documentation to describe exactly that.

View on HN

That's one of my issues, of course. With half-automated/decided by unaccountable forces strict reading of the "law" (store policy) you get outcomes like that. It would be much better to have "spirit of the law" reading of the policies, but that requires engaged staff/high touch verification process. Google is unwilling to go that way so our only recourse is to make a ruckus and hope we'll get the ear of someone who can whisper to the emperor.

It works, but it scales badly.

>engaged staff/high touch verification process

this does not scale well either

Which part of the spyware section were they in violation of? Pretty much everything on that table has to be explicitly enabled and does the obvious thing when it is.

He was sending every domain in a user's contact list to a third party service to retrieve favicons if users enabled the service...and not disclosing that.

More importantly, Google told him that he needed to disclose what he was doing, and his response was petulance. You know the type: "I was speeding because I was LATE TO WORK, officer!"

Further discussion in this comment thread: https://news.ycombinator.com/item?id=31434975

Based on that linked thread, it was off by default, mentioned there might be privacy implementations, and contacted the domain itself (which I would not classify as a third-party - that's the service that is in control of the email address) to retrieve its favicon.

That seems more than reasonable to me (off by default, with a warning!), and would be exactly what I would expect the app to do if I did enable favicons.

The favicon privacy issue seems quite mild to me, but the libreavatar integration should've been listed more clearly.

From what I can tell he didn't just bulk send every domain, only the ones that are visible in the inbox. If you don't receive mail from a contact, I don't think the app ever uploaded anything.

Still pretty bad, and I don't think Google is wrong to flag the app because of this.

However, Google didn't say "if the user enables a certain setting, your app is uploading domain names from your users' contact list to third party avatar services", it said "you're uploading contact list information without disclosing that in the privacy policy".

They seem to know exactly what the problem was but described it in such a vague way that it definitely reads like an accusation of extracting data.

Both are wrong here, but Google is in a position of power and should be held to a higher standard. I'm sure just listing the hostnames that weren't covered by the privacy policy were enough to prevent this whole situation.

It is good that these things were opt-in but I disagree that the implications were obvious. There is an entire spectrum of implementation options for many of these features regarding how much work is done on the device and how much is done on an external server, and thus what data must be sent to the service. The user needs to have this explained to them so they can make an informed decision.

Reply on news.ycombinator.com