Database Info

[Q] Android app security

While I'm waiting for my GS2 (my first Android device) to be shipped I have been doing a little research into the apps and general security and was shocked to find that many apps actually leak private information and data back to ad servers. This scares me a little. I don't want my location, and other personal data being sent to places I haven't authorised.
Is there any way of being able to stop or block this or any way of identifying which apps do this? How can one know if a publisher of an app can be trusted?
I try to keep my PC locked down from this sort of thing and want to do so with my phone. I just want to be able to make an informed decision with Android.

There is a app called Permissions Denied that can do that.

When you download an app from the market, it tells you what permissions theapp has to have. Most of th time, the permissions aren't for what you think. Internet connection is usually cause it has ads. Also, see what the apps are rated, and read the comments to see if the app is trustworthy.
[sig]I'm close to root, im patiently waiting on those puzzles[sig]

First thing I downloaded when I bought my EVO was Lookout mobile. Very good AntiVirus app with free features that Sprint is trying to sell with their own junk. Try it out.

Thanks for the comments guys. The thing is how do you really know that the app is not maliciously harvesting your data?
Take the Lookout Mobile app triagetoday mentioned above. Now, I'm only using this app as an example and am not saying that there is anything wrong with the app as I've not used it. But it makes a good example.
The app wants permissions for everything. Most user comments are positive, there are a few that say that they cannot uninstall it which is worrying but generally the comments are favourable. But how can I be sure that this app wasn't written to harvest data on the pretence that it's protecting your phone? In fact there is even one comment suggesting just that. I can't see anywhere where I can look at the source code so is it a case of blind faith and hope the publisher is not malicious?
After reading many reports about huge increase in malware on Android and data leakage it's a real concern on how to protect your data.

found app that keeps location private from google

found an app called Location Cache Map in market and it seems from what it says that it prevents maps and other apps from setting location data on phone and clears map cache while still allowing full use of GPS functions. i tried it and it worked, though it takes an extra couple seconds to lock on.
seems to work. you can see your stored location data with it even if you dont want to block location cache. interested in hearing from others on if this seems to really be working.

Any aftermarket Rom do this.
Sent from my LG-P999 using XDA Premium App

sure if ya delete maps or something. mine always still saved location data on my phone. this lets you use the functions without phone saving cache data. ive never seen this function on any rom ive used. but if so id like to know how and save some time.

Has anyone else tried this?

Google has always kept this type of information---even before android. It's in their terms and conditions. Honestly, anyone who doesn't want to give Google access to this information, shouldn't use their phone.

aczarney said:
Google has always kept this type of information---even before android. It's in their terms and conditions. Honestly, anyone who doesn't want to give Google access to this information, shouldn't use their phone.
Click to expand...
Click to collapse
You should, at minimum, have the choice to turn it off and delete the data that is stored on your phone readily.

Let's get real, corporations have too much freedom when it comes to using us as pawns. It should be an option to opt out period. I use google stuff cause I like the way it works, they don't need my location for that.
Sent from my HTC Vision using XDA App

Google's been collecting information rather openly for years. I just don't get why people are surprised they are collecting it with their phones too. It was never really a secret. There's no option to turn it off simply because that's the terms and conditions for use of the phone--that Google is entitled to access to your location as well as other information regarding how you use your phone. It honestly is like they're watching your every move. If you don't want access given to Google for this information, don't use the phone. That's literally your only option, and legally, Google is completely backed up on that. Now apple, that's a different story. But Google has been doing these things ever since Google as a company was created, its actually part of what has allowed them to grow. To know how their services are used and how their users function more or less.

I could really care less. Ask yourself. What is Google going to do with your information besides direct ads based on you interest. As long as Google execs aren't going to come track me down, I could really care less what data they collect. If your worried about people collecting your data then don't ever buy anything off the internet or for that matter, don't ever use a credit card to make purchases.

read this. its a rant but its how it REALLY is.
Grammer and spelling errors warning!!!
its doesnt matter what they are going to do with it. i have a right to privacy. the more you look into your specfic settings for your google and gmail account, the more you'll see that a lot of what they ask for they don't tell you. they allow you to turn it off.... if you even know how to where to find it, or if you even know they are collecting it.
they keep much more than just location and basic data for ads. im not going to get into all of it because theres too much. go look for yourself.
basically these days to have a phone thats fun (smartphone) you are forced to choose iOS or Android. Both are bull**** when it comes to privacy. THATS WHY THEY ARE DEFENDING THERE ASSES IN COURT!!! Just the fact that it has gotten to the point of major national news shows that it isn't just nothing. $500 million lawsuits aren't to be taken lightly.
And it's not just my privacy. Many MANY apps and services including googles require access to many things that the app has absolutely no reason to have. theres a dev in the market called FREE WING go download his persmissions apps named after specific permissions example: READ_PHONE_STATE, it shows you some of what that permission pulls from your phone such as your name, device ID, phone number, contacts, and more. SMS permission had not just the ability to "tell if i get a text" but has, and records, everything that was said, who sent it, and their numbers. or go get an app called "Denied permissions" it will show you how many each app has and break them down and explain a little of how they work. then use it to look at Google Docs app permissions. it shouldn't have the ability to change,delete, modify my account passwords, and that's just one of its BS permissions.
any facebook app that uses facebook to as an alternative log in gives that app by DEFAULT the ability to read my contacts, status, my FRIENDS status and apps they are using, where they also go, their photos, mine, and more (go to the apps privacy settings on facebook to find this stuff). my friends apps one THEIR phone have access to MY personal information, just because we are associated in facebook. NOT COOL! Facebook just told its game devs a couple days ago that they had like a week or something to change their games to prevent 3rd party apps that are associated with their games from accessing or keeping their patrons information while they play their games.
basically it comes down to my information can be accessed by places i didn't give the OK to or even have heard of. google shares information with apps. try reading the privacy polices for apps sometime (go read AppPack's - Highlight app and T-mobile Mall's app privacy policies). its like the fine print that no one ever reads in contracts or car advertisements. its there but no one takes the time.
google used to be a damn search engine. now they own android, google, Google Chrome OS (just came out), admob, and more. im ok with ads. and them having info i know i asked them to hold on to. I can't imagine what dirt someone could find on someone running for president in 10 years. dirty pics from when someone texted them when they were 25, 18, 16. or their online diary they kept for some reason. things they said on a forum, damn i couldn't imagine my old myspace stuff. some of that could get me in to trouble. i was a party animal at the time. ya see where i'm going? wouldn't have posted that stuff 10 years ago if i had known what i know now.
theres enough info of ours unintentionally online and accessible. go google yourself. they don't need my location to boot
don't believe any of this then take some time to read what you are saying ok to. some privacy policies are like when in those cartoons (devil and daniel mouse) the devil asks you to sign a contract in your own blood, but you forgot their was stuff written on the back page.

But you don't have a right to privacy.....you agreed to the terms and conditions of Google's use when you began using your phone. You signed those rights to privacy away when you signed that Google account into your phone (which, in fact is where the agreement to the terms and conditions lie). You installed Google docs and said "yeah, its okay if this app has access to these things." You update your Google apps every release of a new version. Apple is having issues with this yes, but that's because it was never previously a part of their terms, and they were doing it without customers knowledge. Google is not having issues, will not have issues, and presented all that information to you upfront when you signed up for your Google account, well within your buyer's remorse. Likewise, they do have an option to opt out of "Location services" during most device's initial setup procedures. I bet if anyone sued Google, they wouldn't even prepare a case. They'd refer the judge to the terms of your Google account or those permissions you were okay with.
Bottom line, Yes you have your right to privacy. But you can't give away those rights away to Google or Facebook or whoever then complain about it. Those terms and conditions aren't just there for show, they create them for these specific reasons. It'd be like If I gave you my social security number, checking account number, and address and then was shocked when my identity was stolen and went to file a police report. Working for T-Mobile, I hear these types of arguments on a daily basis, but let me just say it hasn't once changed a thing. Once you agree to them, you can't change your mind until the terms are changed and presented to you again.

I've said it before and I'll say it again. If you like privacy, DO NOT USE A SMARTPHONE. You see, I use a smartphone because I could give two ****s less what Google has access to in my phone. There are only 9 numbers I don't want anyone having access to and lets be honest. I highly doubt Google is stealing our SS #'s.

A link to google and it's work it does for the NSA and CIA. They are more than a company pushing Internet mobile ads. Do not do anything with your phone that you do not want recorded and handed over to the government.
http://www.pcworld.com/article/188581/the_googlensa_alliance_questions_and_answers.html
Remember what google and others did to to people yearning for freedom in China.
http://www.nytimes.com/2006/02/15/technology/15cnd-internet.html

SwiftKey X privacy concerns?

I installed SwiftKey X and it is a amazing, it's ability to predict text is mind blowing. but around 30mins later. I removed it due to privacy concerns. Should I of been concerned about privacy?
Edit: Can a developer have a look at the codes and see what it's been sent back from the advice to the server

Probably not... I also have Swiftkey X. The Swiftkey company is trustworthy but hey, better safe than sorry.

AndriodLover said:
I installed SwiftKey X and it is a amazing, it's ability to predict text is mind blowing. but around 30mins later. I removed it due to privacy concerns. Should I of been concerned about privacy?
Click to expand...
Click to collapse
could you tell us some more about it? what kind of privacy you're talking about? is swift key sending out your details? texts? accounts?

cez10 said:
could you tell us some more about it? what kind of privacy you're talking about? is swift key sending out your details? texts? accounts?
Click to expand...
Click to collapse
First for best performances it needs access to your facebook, Twitter, gmail accounts. Second, why does a keyboard needs a services running in background at all times ? that can be sending data back to the server.
Third, Have a look at the privacy details http://www.swiftkey.net/privacy.

AndriodLover said:
First for best performances it needs access to your facebook, Twitter, gmail accounts. Second, why does a keyboard needs a server running in background at all times ? that can be sending data back to the server.
Third, Have a look at the privacy details http://www.swiftkey.net/privacy.
Click to expand...
Click to collapse
Oef... where's the limit. It's like typing in Bentham's Panopticon.

appelflap said:
Oef... where's the limit. It's like typing in Bentham's Panopticon.
Click to expand...
Click to collapse
??

AndriodLover said:
First for best performances it needs access to your facebook, Twitter, gmail accounts. Second, why does a keyboard needs a services running in background at all times ? that can be sending data back to the server.
Third, Have a look at the privacy details http://www.swiftkey.net/privacy.
Click to expand...
Click to collapse
"In relation to our Apps such as SwiftKey, learned language data generated and stored on your computing devices, such as mobile phones and tablets, is never accessed by, or transmitted to us unless you wish to use additional features or services which would require the use of such data. Where we offer any additional services or facilities that do require use of data which might include personal information, such as server-based personalized services, then we will always seek your consent to the use of such data before providing such services or facilities."

Hey - just to weigh in quickly here. I'm the CMO of TouchType, the company that makes SwiftKey. We take user privacy very serious and don't ever process any of the data stored on your phone, as explained in our privacy policy.
When you choose to use our personalization services, this data is handled securely and without access to any of your password data. We only use your data to provide you with better predictions, though a language module that is generated and pushed to your phone.
There is really nothing to worry about here.
Thanks guys,
Joe

Thanks for posting, that's good to know. Might I say that I've been using the keyboard for a few days and it's definitely getting better.
Sent from my Nexus One using XDA Premium App

haha privacy concerns? whaaaat

Privacy ?? Mistrust...

hmm it does ask for a lot info

JoeBeats said:
Hey - just to weigh in quickly here. I'm the CMO of TouchType, the company that makes SwiftKey. We take user privacy very serious and don't ever process any of the data stored on your phone, as explained in our privacy policy.
When you choose to use our personalization services, this data is handled securely and without access to any of your password data. We only use your data to provide you with better predictions, though a language module that is generated and pushed to your phone.
Click to expand...
Click to collapse
Thanks for answering here.
Just to clarify, when the "Learn from SMS" option is used, does SwiftKey upload or submit SMS text data stored on the phone to your servers or is everything processed on locally the phone?

anti-pop said:
Thanks for answering here.
Just to clarify, when the "Learn from SMS" option is used, does SwiftKey upload or submit SMS text data stored on the phone to your servers or is everything processed on locally the phone?
Click to expand...
Click to collapse
I wonder the same thing. Does anybody know the answer?

Personally, I would use a firewall such as avast to block out any apps I don't want reaching out to the Internet. Especially for all my keyboard apps.
And yes, you could use a packet sniffer to monitor swift or any other app you are unsure about.

a4ol said:
Personally, I would use a firewall such as avast to block out any apps I don't want reaching out to the Internet. Especially for all my keyboard apps.
Click to expand...
Click to collapse
Totally agree on this point. Use DroidWall, PDroid or LBE and feel safe? :> Using PDroid and LBE you could even configure SwiftKeyX to not be able to read any parts of private informations from your phone that you don't acknowledge.
Hope this helps The Keyboard as it rocks, i tested the trial-version myself. Too bad they don't have a free lite edition or something like that. As long as you need to pay for it i'm not jumping on that train, sorry ;/

I don't agree at all with the "CMO" of SwiftKey. The app is a huge privacy concern.
I just did a logcat and was more than shocked: The app completely misuses users trust by tracking him permanently. The logcat not even comes to equilibirum, permanently are requests made to http://api.geo.kontagent.net. To get feel how "serious" the company is about privacy, take a look here: http://www.kontagent.com/privacy-policy. Just as an example: "Kontagent employees, may, on occasion look at customer data for test purposes". Collected data includes social application data, custom data, cookies, location (!). Personally I "just" saw that serial number, phone type, ID etc. is transmitted. Plain text - no SSL - of course. I block my data anyways using XPrivacy and Droidwall and needless to say, I disabled all the clous services but this app immideately leaves my device. A keyboard is the most sensitive and important app on the device. It records everything, every single keystroke and sending out anything here is an absolute no-go. Breach of trust. I paid for the app, felt good about it and now I feel shocked how this company spies it customers.
My recommendation for everyone who takes security or privacy a little bit serious: Get rid of the software. Uninstall it immideately!
It's sad because the software is good but spying without opt-out on paying customers is unacceptable!

sharing apps under my google account

scenario:
I wanna swap phones with my wife. BUT still share the apps that I bought under my gmail account.
on iOS, I can still share apps I bought but keep my contacts/iMessage separate as iCloud and appstore login are different parts of the OS.
Seems in Google ecosystem, it's either I share both my account and the apps I paid for? I know I can unticked "sync contacts" in the Google account setting on the phone. But it's easy to tick it again. I just want to install the apps and then have it updated automatically.
Thanks
ps. did search the net but nothing came up

You have to link the account you bought the apps on to the device. Its the only way to do this. If you untick the other sync options then contacts etc don't get synced. Thats the best you can do
Sent from my GT-N7000 using xda premium

Wow they need to make this process a bit better.

YounGMessiah said:
Wow they need to make this process a bit better.
Click to expand...
Click to collapse
Why? If you pay for an app on your device, why should you have the right to stick it on someone else's device just because you feel like it?
What they need to make easier is the ability to migrate your entire user account to a new one and keep all your settings, purchased apps etc as that is, currently, not possible.

SimonTS said:
Why? If you pay for an app on your device, why should you have the right to stick it on someone else's device just because you feel like it?
Click to expand...
Click to collapse
I'm not talking about just anyone though. I can install apps I paid for on my son's and wife's ipad. He likes this music app I have on the ipad/4s. I bought a $200 app for my son 2 weeks ago. I would be VERY VERY annoyed if I need to buy it again just because I need to install it on the wife's ipad.
BUT I guess Apple allows a person to install an app on multiple devices that I manage (we got various iOS devices in the house and 1 HTC One X acquired last week just because I wanna try something different).
Seems google does not. Well google does too except privacy concerns can/might be a problem.
But I haven't bought much apps probably less $20 so buying them again is not a problem right now.

mrjayviper said:
I'm not talking about just anyone though. I can install apps I paid for on my son's and wife's ipad. He likes this music app I have on the ipad/4s. I bought a $200 app for my son 2 weeks ago. I would be VERY VERY annoyed if I need to buy it again just because I need to install it on the wife's ipad.
BUT I guess Apple allows a person to install an app on multiple devices that I manage (we got various iOS devices in the house and 1 HTC One X acquired last week just because I wanna try something different).
Seems google does not. Well google does too except privacy concerns can/might be a problem.
But I haven't bought much apps probably less $20 so buying them again is not a problem right now.
Click to expand...
Click to collapse
Two things I can see with this - and feel free to say if my understanding is wrong ... but firstly, $200 on an app? F**k me
1) You can install the Apple app on up to three devices - but they all have to be linked to your Apple ID? How is that any different from using the same base Google account linked into multiple devices?
2) I can install my purchased apps on my HTC Desire S and my Nexus 7 tablet - because I use the same Google account on them both. I also have my account linked to the Play Store on my Dad's LG Optimus 4X, so I can install my paid apps on there, but because I don't set it to sync anything else (as pointed out by Zac) he only gets access to my apps, not my contacts, emails etc.

SimonTS said:
1) You can install the Apple app on up to three devices - but they all have to be linked to your Apple ID? How is that any different from using the same base Google account linked into multiple devices?
Click to expand...
Click to collapse
because the contacts/calender/etc syncing (iCloud) and AppStore can be different Apple IDs. I could login on the AppStore as [email protected] and use [email protected] for iCloud/iMessage/Facetime. Even iMessage can use [email protected] if I choose to do so. maybe Facetime too (not really sure I haven't looked at the Facetime settings much but I'm sure about iMessage)
SimonTS said:
2) I can install my purchased apps on my HTC Desire S and my Nexus 7 tablet - because I use the same Google account on them both. I also have my account linked to the Play Store on my Dad's LG Optimus 4X, so I can install my paid apps on there, but because I don't set it to sync anything else (as pointed out by Zac) he only gets access to my apps, not my contacts, emails etc.
Click to expand...
Click to collapse
I did mention privacy concerns. It's easy enough for your dad to tick sync contacts on his device. Or maybe use some other Google services like Google+/etc. haven't really used those so I qualified my reply to maybe.

mrjayviper said:
because the contacts/calender/etc syncing (iCloud) and AppStore can be different Apple IDs. I could login on the AppStore as [email protected] and use [email protected] for iCloud/iMessage/Facetime. Even iMessage can use [email protected] if I choose to do so. maybe Facetime too (not really sure I haven't looked at the Facetime settings much but I'm sure about iMessage)
I did mention privacy concerns. It's easy enough for your dad to tick sync contacts on his device. Or maybe use some other Google services like Google+/etc. haven't really used those so I qualified my reply to maybe.
Click to expand...
Click to collapse
I fail to see the difference really. If you create a Google account specifically for purchasing the apps and don't use it for email or anything else then you can just use that on the other person's device - yes, they would be able to sync contacts (which don't exist) or send email (so what). If you are planning on sharing your apps with a person who you trust that little then you probably shouldn't be doing so in the first place.

it's not about trust but the flexibility in the OS. seems Google isn't as flexible as it seems. It's flexible in some areas (having other keyboards/themes/etc) but in this case, it seems it's not at least compared to what the other major competitor can do.
I plan to have another account I will be using to purchase apps. It was suggested in another forum.

mrjayviper said:
it's not about trust but the flexibility in the OS. seems Google isn't as flexible as it seems. It's flexible in some areas (having other keyboards/themes/etc) but in this case, it seems it's not at least compared to what the other major competitor can do.
I plan to have another account I will be using to purchase apps. It was suggested in another forum.
Click to expand...
Click to collapse
Not trying to be picky, but that argument doesn't stand up. The way that the ability to share apps works has absolutely nothing to do with the OS. Google is NOT the OS - Android is. Android is massively more flexible than iOS is, but Google don't implement some things as well as they could - partly because they don't make as much money from the OS, partly because of the very nature of the open-source structure and partly because they don't go round suing the backside off everybody else on the planet.

When I said Google, I actually meant android. I just got my 1st Android device last week and my terms aren't as polished as yours.
and let's not bring the lawsuits into the topic. don't really care much for them and VERY much off-topic. I'll buy whatever suits my fancy and in this instance, the HTC One X won.

life without gapps aka google apps

Moderators PLEASE READ THIS THREAD BEFORE DELETING IT LIKE YOU DID THE LAST ONE
I did a couple of different searches on this board, looking for an alternative to gapps aka google apps. What viable alternatives to the google play store are there? google hangouts and google mail? I came across a thread discussion nogapps and the blank store that comes with it, but i'm not overly convinced that it lacks google's data mining processes.
I am not asking for sites that provide "pirated software" as I already know where to get that. I am asking for a "store" where I can search various phrases, and get a good return without those apps being relinked to google play store.

Have you tried the Amazon App Store? (Yes, they have Android apps)

Am I correct in assuming you are looking for a market that is completely separate from Google's servers? If privacy is your concern, you should know that all services that are provided for "free" employ some sort of data mining, because that is how they can afford to keep those services running. Since Google Play is the largest repository for Android apps, you would be hard pressed to find another service that hosts all of the same .apks, as that would seem redundant.

There simply is no viable alternative to the Play Store.
You can get alternatives, but they won't be nearly as good.
As for the rest of the gapps there are plenty of alternatives that are just fine or better.
Why are you so against gapps though? Washington doesn't care what apps you use.
Sent from my GT-I9000 using xda premium

Even if the app doesn't mine your data, your ISP still does ...

plenty
well there are plenty stores available on internet. if you are on android 4.1 and rooted then you can install NOKIA app store. well its tricky to use, you can find a apk on xda. when you install it just install aptitode market from there, though aptitode can be installed alone too. you can find almost all apps. but still google holds android that will mean they will have the maximum apps and secure and most updated apps. even developers always put latest updated apps on play store first. well i used wildfire which has no gpu so cpu has to do work for most of operations which makes slow and to overcome the low space on that phone i sometime skip the gapps. it depends if you want surveillance free android then go for other market apps.:silly:..google even know when you are walking. i read this on xda somewhere.:laugh:
choice is yours.

100s of stores are available nowadays...
Gmail alternate is aosp email
Maps run without email account...
What else u need?

doctor_droid said:
What else u need?
Click to expand...
Click to collapse
A way to synchronize (not backup/restore) my contacts and calendars on the Internet (Mega, Dropbox, whatever...) to be shared among other devices. This is bare minimum.
Then, if I could also synchronize (again, not backup/restore)some system stuff like WiFi passwords, call logs, SMS/MMS, instant messaging stuff and some application settings, this would be an extra great feature.
Can you do it without GApps? If you know how to, please share!

I don't know if this idea will benefit the app devs. Getting rid of the play store is like taking away one of their BIGGEST market place. What do you think?

People wouldnt feel the need to seek alternatives if Google wasnt so hardcore with it
Like dam, is it really even reasonable to keep location tracking in the background 24/7 and 15 different types of loggers at once? You'd think those morons would understand how large of a percentage of their would-be-users would actually use more of their services if they didnt chose to make it an all or nothing affair. I literally use only the playstore, and because of whats needed for that I go ahead and utilize the sync. I would definitely be open to gmail, g+, etc. if they werent so retarted with it. Rant over.

carlfinity said:
don't know if this idea will benefit the app devs. Getting rid of the play store is like taking away one of their BIGGEST market place. What do you think?
Click to expand...
Click to collapse
I think more about my privacy than the app business.
I wish in could use something like CM with some synchronizing mechanism.
Unluckily for me I have a non-dumb-phone, a netbook and a desktop PC.
I use all three for work and would need some synchonization mechanism for calls, SMS and other stuff.
Do you have a suggestion in this direction?

I have read the opening post. So please remember that.
However, this kind of question will always lead to warez sites.... As it already has. And will continue to. And another thread asking same thing will lead to warez app responses yet again.
Google play store and Amazon are really the only ones that are legit and most other sites offer cracked versions of paid apps.
Obviously a website dedicated to Development and developers will not approve of most of the recommendations here, which I have deleted.
Please don't open another one of these threads. There's been enough answers provided already. So this thread is closed.
Thanks for understanding,
Darth
Forum Moderator