Comment by AnonCoward42 | Hacker News Reader

Comment by AnonCoward42 | Hacker News Reader

Permissions from Aurora Store (3rd party to Play Store):

Hayya:

- control vibration

- have full network access

- prevent phone from sleeping

- run at startup

- run foreground service

- view Wi-Fi connections

- view network connections

- access sensor data at a high sampling rate

- access approximate location only in the foreground

- access precise location only the foreground

- listen to C2DM messages

Etheraz:

- access bluetooth settings

- control vibration

- disable your screen lock

- have full network access

- pair with bluetooth devices

- prevent phone from sleeping

- run at startup

- run foreground service

- this app can appear on top of other apps

- view Wi-Fi connections

- view network connections

- access approximate location only in the foreground

- access precise location only the foreground

- directly call phone numbers

I don't think these are really that extraordinary, but some are not obvious to me at least. Especially "listen to C2DM" seems odd, possibly a side effect of another permission. Of course with these permissions you can track and trace most of your life, but that is now the norm unfortunately.

> In particular, the covid-19 app Ehteraz asks for access to several rights on your mobile., like access to read, delete or change all content on the phone, as well as access to connect to WiFi and Bluetooth, override other apps and prevent the phone from switching off to sleep mode.

The statement about delete/change all content on the phone seems false tho. Also it doesn't "override other apps" whatever that should mean, but can draw over other apps.

edit:fix formatting

I'm guessing they used some framework and the libraries they used ask for a broad set of permissions because they offer access to their functions. But they're not necessarily used.

Also considering they're asking for a permission for a protocol that was shut down 7 years ago, the framework must be quite old. Android permissions were less granular back then.

I know someone in Germany and their covid tracking app tells you when and where you were close to someone who was last tested positive. So everyone does it the same way, recording location.

> I know someone in Germany and their covid tracking app tells you when and where you were close to someone who was last tested positive. So everyone does it the same way, recording location.

Not sure about Germany, but in France the app doesn't track location. It tracks nearby devices (with Bluetooth, rotating identifiers frequently), and when one marks oneself as positive, it informs the central server of the identifiers used in the last X days, which then other apps checks against their list of known identifiers that were close.

So there is no recording of location.

My friend was definitely told where he was on the last contact. Doesn't mean his location left the phone though.

[He didn't get Covid this time, but off topic for this discussion.]

Edit: or maybe it's on topic because the location was at some amusement park outdoors. Since he knew where and it was relatively safe, he didn't have to worry much about the test results...

No, definitely not. There is no location info anywhere in the app, and never has been.

Obviously you can enter "library visit" in your contact diary manually, but even then there is no location involved, it's just a string of characters.

There isn't even a specific point in time given, only the day.

I believe in android bluetooth requires some location permission, because it can be used to identify your location.

It only tells you on which day you had "one" or "multiple" contacts with "low" or "high" risk. It's Bluetooth based, and the CoronaWarnApp doesn't even access location data.

See https://www.bundesregierung.de/breg-de/themen/corona-warn-ap...

"Data which can make a person identifiable, in particular location data, is not selected, used or stored."

Hmm. Maybe my friend knew exactly where he was then.

Too bad I can't edit the original comment any more.

Never trust friends :)

> Also considering they're asking for a permission for a protocol that was shut down 7 years ago, the framework must be quite old. Android permissions were less granular back then.

That’s not how PlayStore permissions work. You have to target a certain Android version to release update apps and that version dictates how permissions work. You can’t get around those requirements by using an old framework.

Yeah, but old framework needed one permission that split into 3. Now it asks for all 3 permissions because they didn't hold to think that they only need 2 of them, and even those not always.

Ah of course, I didn't think about that.

Giving the benefit of the doubt to naivety is reckless in a security context.

> Also it doesn't "override other apps" whatever that should mean, but can draw over other apps.

It's a permission designed for accessibility. Because it's so intrusive you usually have to go through a more complex flow to enable it.

"override other apps" is a defensible colloquial definition because it enables clickjacking. Clickjacking is when you overlay an opaque, innocuous overlay and then open something you maliciously want to trick the user into clicking behind it.

"listen to C2DM" is for push notifications iirc

C2DM was shutdown in 2015 (https://developers.google.com/android/c2dm/)

This name (and GCM, google cloud messaging) still lingers inside packages and error messages when only Firebase Cloud Messaging (FCM) now exist.

I wonder if any of those permissions could be used to give the app access to raw touch screen data. In theory only system drivers should be able to. If possible, it would pose a huge security risk: raw touch screen data reveal where the user taps before the data is sent to any security layer, so that by simply matching the coordinates to the known shape of the virtual keyboard, a malicious app would easily find text, including all passwords.

No, they can't, for the reason you explained.

Permissions analysis of Etheraz from Exodus, for comparison: https://reports.exodus-privacy.eu.org/en/reports/com.moi.cov...

1 TRACKER

- AltBeacon

19 PERMISSIONS

- ACCESS_BACKGROUND_LOCATION

- ACCESS_COARSE_LOCATION

- ACCESS_FINE_LOCATION

- ACCESS_NETWORK_STATE

- ACCESS_WIFI_STATE

- BLUETOOTH

- BLUETOOTH_ADMIN

- CALL_PHONE

- DISABLE_KEYGUARD

- FOREGROUND_SERVICE

- INTERNET

- QUICKBOOT_POWERON

- RECEIVE_BOOT_COMPLETED

- SYSTEM_ALERT_WINDOW

- VIBRATE

- WAKE_LOCK

- BIND_GET_INSTALL_REFERRER_SERVICE

- GET_COMMON_DATA

“access sensor data at a high sampling rate“

If that isn’t some terminator shit right there, I don’t know what is.

Would it even be useful to access data like gyro, accelerometer, compass or proximity sensor at low rate useful? And what really is high sampling rate?

> If that isn’t some terminator shit right there, I don’t know what is.

This seems an odd statement. You access sensor data at a higher rate for doing things like sports apps (eg, Strava) or many other scenarios. It's behind a permission at least partially because of the potential impact on battery life.

It can be an incremental decrease in privacy (although not especially concerning if the app already has low sample speed access) but it is unclear why this is some kind of terminator issue.

Reply on news.ycombinator.com