Excessive permissions - AT&T Samsung Galaxy S II Skyrocket SGH-I727

What's up with all these apps out there that require the ability to create network sockets, read network state, take pictures using the camera, etc? I'm talking about simple apps like a flashlight or power button.
I'm somewhat new to android, and it seems to me that some of the stuff out there is borderline malicious, or at least has the capability to be so.

In the app's Play Store description or on their website, some developers explain what their permissions are for. I suppose that can be taken with a grain of salt, as a app with malicious intent isn't going to say what it really does. But I do find it useful to hear what the app dev says it's permissions are used for.
Sent from my SAMSUNG-SGH-I727 using xda app-developers app

Try LBE Privacy Guard for filtering permissions.
Sent from my SAMSUNG-SGH-I727 using xda app-developers app

pc103 said:
Try LBE Privacy Guard for filtering permissions.
Sent from my SAMSUNG-SGH-I727 using xda app-developers app
Click to expand...
Click to collapse
Thanks for the recommendation.
Seems like CM7 had the ability to disable individual app permissions...I wonder about CM9. I haven't used it long enough to find out if that feature carried over.
Sent from my SAMSUNG-SGH-I727 using xda app-developers app

Perhaps I don't know enough about these apps, but these sort of permissions make me suspicious. Below are the permissions for LBE. Why would a program reportedly designed to protect users from malware require this much latitude?
Send SMS messages.
Write to external storage.
Read the low-level system log files.
Access coarse (e.g., Cell-ID, WiFi) location.
Initiate a phone call without going through the Dialer user interface for the user to confirm the call being placed.
Read only access to phone state.
Get notified that the operating system has finished booting.
Open windows using the type TYPE_SYSTEM_ALERT, shown on top of all other applications.
Modify of the telephony state - power on, mmi, etc.
Open network sockets.
Access fine (e.g., GPS) location.
PowerManager WakeLocks to keep processor from sleeping or screen from dimming.
Call any phone number, including emergency numbers, without going through the Dialer user interface for the user to confirm the call being placed.

eagle0042 said:
In the app's Play Store description or on their website, some developers explain what their permissions are for. I suppose that can be taken with a grain of salt, as a app with malicious intent isn't going to say what it really does. But I do find it useful to hear what the app dev says it's permissions are used for.
Sent from my SAMSUNG-SGH-I727 using xda app-developers app
Click to expand...
Click to collapse
LMAO tlkin about 'flashlight' using 'camera' permissions xD
You ARE aware the flashlight app uses the flash, which is part of the camera, right?
Without the permission, youd basicly have an icon

doug36 said:
LMAO tlkin about 'flashlight' using 'camera' permissions xD
You ARE aware the flashlight app uses the flash, which is part of the camera, right?
Without the permission, youd basicly have an icon
Click to expand...
Click to collapse
Heh. Misunderstanding.
Sent from my SAMSUNG-SGH-I727 using xda app-developers app

eagle0042 said:
Yes, I'm perfectly aware of that. And obviously, so are you.
Sent from my SAMSUNG-SGH-I727 using xda app-developers app
Click to expand...
Click to collapse
Lmao sorry didnt mean to quote u, meant to quote OP

doug36 said:
Lmao sorry didnt mean to quote u, meant to quote OP
Click to expand...
Click to collapse
Lol its all good. I was slightly confused, and I actually was feeling defensive about it. I think I just need to go to bed. Lol.
Sent from my SAMSUNG-SGH-I727 using xda app-developers app

Tref said:
Perhaps I don't know enough about these apps, but these sort of permissions make me suspicious. Below are the permissions for LBE. Why would a program reportedly designed to protect users from malware require this much latitude?
Send SMS messages.
Write to external storage.
Read the low-level system log files.
Access coarse (e.g., Cell-ID, WiFi) location.
Initiate a phone call without going through the Dialer user interface for the user to confirm the call being placed.
Read only access to phone state.
Get notified that the operating system has finished booting.
Open windows using the type TYPE_SYSTEM_ALERT, shown on top of all other applications.
Modify of the telephony state - power on, mmi, etc.
Open network sockets.
Access fine (e.g., GPS) location.
PowerManager WakeLocks to keep processor from sleeping or screen from dimming.
Call any phone number, including emergency numbers, without going through the Dialer user interface for the user to confirm the call being placed.
Click to expand...
Click to collapse
Your source? Current permissions are listed here: https://play.google.com/store/apps/details?id=com.lbe.security.lite&hl=en However I too don't understand why Google / Manufacturers & Carriers don't set a standard for apps declaring and justifying their permissions. A minority of developers have shown it can be done. Who really wins under the current recklessness?
An excellent thread on last year's release is at http://forum.xda-developers.com/showthread.php?t=1091065&page=1

doug36 said:
LMAO tlkin about 'flashlight' using 'camera' permissions xD
You ARE aware the flashlight app uses the flash, which is part of the camera, right?
Without the permission, youd basicly have an icon
Click to expand...
Click to collapse
What's your point? The LED and the camera are separate pieces of hardware. Using one is not all inclusive to using the other. And even if it were, why does the author list the ability to take pictures with the flashlight? Surely you're not suggesting that everytime the flashlight is lit that pictures need to be taken?
pc103 said:
Your source? Current permissions are listed here: https://play.google.com/store/apps/details?id=com.lbe.security.lite&hl=en However I too don't understand why Google / Manufacturers & Carriers don't set a standard for apps declaring and justifying their permissions. A minority of developers have shown it can be done. Who really wins under the current recklessness?
An excellent thread on last year's release is at http://forum.xda-developers.com/showthread.php?t=1091065&page=1
Click to expand...
Click to collapse
My source is the Amazon App Store. The entity who wins is that which makes use of the information gathered through malicious apps, and/or through the charges which arise as a result of their ability to control unrelated features of the phone.
Android strikes me as a wild west show, where just about anything goes and the lack of true oversight (not to mention ethics), is creating a hazardous condition to which most people seem either unaware or uncaring.

Tref said:
My source is the Amazon App Store. The entity who wins is that which makes use of the information gathered through malicious apps, and/or through the charges which arise as a result of their ability to control unrelated features of the phone.
Android strikes me as a wild west show, where just about anything goes and the lack of true oversight (not to mention ethics), is creating a hazardous condition to which most people seem either unaware or uncaring.
Click to expand...
Click to collapse
More like a carnival or a casino where most patrons ignore the vendors' schemes and the house odds to buy the services. In the end those who care are left to make limited judgement calls about who can be trusted on our phones.
It's interesting that the Play Store posting for LBE lists different permissions from what you found on Amazon. IMO The weakly regulated apps on Play Store are far more likely to be snatching market research for resale to advertisers than trying to tap our finances or steal IDs, but we agree that ethics are barely an afterthought in the race to monetize, and occasionally major criminals will slip through.
For now I'm trusting LBE and amazed at how well my installed apps continue functioning minus the permissions I have blocked. Ditto Startup Manager.

pc103 said:
More like a carnival or a casino where most patrons ignore the vendors' schemes and the house odds to buy the services. In the end those who care are left to make limited judgement calls about who can be trusted on our phones.
It's interesting that the Play Store posting for LBE lists different permissions from what you found on Amazon. IMO The weakly regulated apps on Play Store are far more likely to be snatching market research for resale to advertisers than trying to tap our finances or steal IDs, but we agree that ethics are barely an afterthought in the race to monetize, and occasionally major criminals will slip through.
For now I'm trusting LBE and amazed at how well my installed apps continue functioning minus the permissions I have blocked. Ditto Startup Manager.
Click to expand...
Click to collapse
Yes it is interesting. And to err on the side of caution I'll probably hold off on installing it. If the Amazon description is correct it would become a matter of putting the fox in charge of the henhouse.

Related

Good News for Developers, Bad News for Pirates!!

http://www.engadget.com/2010/07/28/new-licensing-service-replacing-existing-copy-protection-metho/
Looks like pretty soon the days of people copy and pasting apk's all over the place are coming to an end.
I hope this doesn't make theming harder.. We'll see.
From reading that article,
Seems like airplane mode or a firewall would crush all the hopes and dreams of google and app devs.
It seems that every time we open an app it needs to verify that it's been paid for by contacting a "licensing" server and retrieving a response.
I feel like that could slow down launch times, and being unable to use an app when offline would be like UBISOFT hell all over again.
I really hope google puts a lot of thought into this..
I wonder if this if already being done? Every time I try to play that golf game on my EVO on an airplane while the radios are off I get a FC when it starts. As soon as I an on the ground and turn the radios on the game works fine.
Sent from my PC36100 using XDA App
what if you are in an area with no signal or on a plane or something? you cant open any apps???
This is already in place in a number of apps, one is IP Cam Viewer.
I paid the money for it. I transferred all my files to my wife's Evo 4G, and thought "hell I'll see if it works..." Well it didn't. When I try to open the app, it tells me that I have to purchase it from the marketplace.
I'm all for buying apps when they're good, and I understand single user licensing. Guess I was just hoping I wouldn't have to spend double the money for all the apps I use.
simplyphp said:
This is already in place in a number of apps, one is IP Cam Viewer.
I paid the money for it. I transferred all my files to my wife's Evo 4G, and thought "hell I'll see if it works..." Well it didn't. When I try to open the app, it tells me that I have to purchase it from the marketplace.
I'm all for buying apps when they're good, and I understand single user licensing. Guess I was just hoping I wouldn't have to spend double the money for all the apps I use.
Click to expand...
Click to collapse
I've heard of couples sharing the same email as apps get replicated on the two phone
I can confirm that they don't get replicated..
I have two evo's right now under the same email and they're definitely not replicating crap.
cahiatt said:
I wonder if this if already being done? Every time I try to play that golf game on my EVO on an airplane while the radios are off I get a FC when it starts. As soon as I an on the ground and turn the radios on the game works fine.
Sent from my PC36100 using XDA App
Click to expand...
Click to collapse
Now that's a problem I understand about paying for apps but not working when I'm in a place with no signal. I see a law suit brewing up. I paid for the app I should be able to use the app whenever I want to. Class action law suit coming real soon.
Sent from my PC36100 using Tapatalk
Crap....
"A limitation of copy protection is that applications using it can be installed only on compatible devices that provide a secure internal storage environment. For example, a copy-protected application cannot be downloaded from Market to a device that provides root access"
...Seriously???
EDIT - the above quote was misrepresented in the place I copied from...research shows it to be misleading. the actual bit of Google's text is posted over on page to of this thread. disregard my indignation in this post...
This is discouraging, because a lot of people like to try the full before they buy it expecting more than what full has to offer, only to be disappointed later.
willwgp said:
This is discouraging, because a lot of people like to try the full before they buy it expecting more than what full has to offer, only to be disappointed later.
Click to expand...
Click to collapse
You do get a 24 hour refund option when you buy from the market so I'm not worried about trying before you buy. I do worry about not being able to play something when I'm in the bathroom at work because I don't get a signal there.
well how many ppl do actually piracy apps??? oh my bad forgot that this is Android, for a second i though it was apple!!
Just to clarify a couple of things:
There are 2 ways to use the Licensing - one is Strict - you CAN NOT USE THE APP WITHOUT ACCESS TO MARKETPLACE. Personally, screw that.
Option 2, however, is a non-strict policy. Server managed, where the license is 'cached' to storage. You also can programmatically set how long your app can be used without any license check.
That'd be the way i go
josue85 said:
You do get a 24 hour refund option when you buy from the market so I'm not worried about trying before you buy. I do worry about not being able to play something when I'm in the bathroom at work because I don't get a signal there.
Click to expand...
Click to collapse
That'll be up to the developer. I like this approach, as I'd be happy to do say... a 5-7 day turn around on the license check. After 7 days with no data signal, seriously, where the hell are you? LOL
Besides, if you've used a paid app for 7 days, and by that time can't decide if you need it or not - wow.
And of course, as soon as you got signal again, the license check would go through and you can use the app again, no problem.
I'm sure there will be UbiSoft and EA style implementations though - way too damn draconian for my tastes. I don't care to know every single second that someone's using my app. I would just like to know that they haven't 'copied that floppy' as it were LOL
I have no doubts this will be defeated in time, though. All it would really take is mimicking the server license response, which can be extracted from the locally cached license of an actual paid product.
People that pirate software are going to do it, regardless. Don't make the honest people pay the price of draconian DRM.
The best approach I can make as a developer, is give my customers the features they want, in a stable, good performing package, and discourage 'casual' piracy. Beyond that, it's out of the developer's control, and honestly, any more than that usually just pisses off the customer and annoys the pirates for about a day and a half.
Ok...had to read the SDK paperwork as I really wanted to know this...my previous post was incorrect and here is the update...
From Google:
Android Market Licensing is a flexible, secure mechanism for controlling access to your applications. It effectively replaces the copy-protection mechanism offered on Android Market and gives you wider distribution potential for your applications.
A limitation of the legacy copy-protection mechanism on Android Market is that applications using it can be installed only on compatible devices that provide a secure internal storage environment. For example, an application using the copy-protection mechanism cannot be downloaded from Market to a device that provides root access, and the application cannot be installed to a device's SD card.
With Android Market licensing, you can move to a license-based model in which access is not bound to the characteristics of the host device, but to your publisher account on Android Market and the licensing policy that you define. Your application can be installed and controlled on any compatible device on any storage, including SD card.
Click to expand...
Click to collapse
Also...there are options for the Devs to allow for apps to be used a chosen number of times before they need to check in for licenses. Strict has to check in every time....other option allows dev to choose based on times used or time since last check in.
SO...all in all I am much less worried about this now.
topdnbass said:
I can confirm that they don't get replicated..
I have two evo's right now under the same email and they're definitely not replicating crap.
Click to expand...
Click to collapse
With licensing the dev can choose whether an app can be accessed from different phones. It is an option...
(greeked...multiple times)
Question: Does that mean we won't be able to open, modify, and resign apks? Like...to change the appearance (make a widget clear, etc).
More like bad news for paying consumers. That's who always pays for everything. Those of us who actually buy the products.
I plan on speaking with my wallet. I wont buy any app that requires I have an internet connection.
A limitation of the legacy copy-protection mechanism on Android Market is that applications using it can be installed only on compatible devices that provide a secure internal storage environment. For example, an application using the copy-protection mechanism cannot be downloaded from Market to a device that provides root access, and the application cannot be installed to a device's SD card.
Click to expand...
Click to collapse
Wait so according to google us rooted folk couldn't download copy-protected apps before now?
Urrr, i think im missing something
This is actually a nice implementation for both the software developer and the user. Most will implement this where it only has to check-in every week or two. So the odds of getting caught in a spot where there is no connection is low.
At the end of the day, it is a pretty straightforward way to handle copy protection that really shouldn't inconvenience anyone.
Also it will bring more developers to the platform if they know they don't have to worry as much about piracy.
Piracy will still run rampant. People will find ways to circumvent this, that's just how it is. At least it will curb some piracy since copying and pasting an apk file wasn't much of a deterrent.

Taintdroid...android's duff security model

Worrying article on how apps are using personal information.
www.theregister.co.uk/2010/09/30/suspicious_android_apps/
I'm sick that they had to go too such lengths to find out. We need a better net architecture to enable a proper firewall to work.
Sent from my HTC Desire using XDA App
Also, app naming FAIL!
Well, since they only tested 30 apps and won't release the names of the ones they tested, only saying that they are "the most popular", personally I don't buy it.
And the information these apps are sending out is primarily geolocation. Well, no ****. If an app wants your location and you don't think it should have it, it's either using it for ads or you should decline to install the app and just send an email to the dev asking him why he needs that information.
tjhart85 said:
Well, since they only tested 30 apps and won't release the names of the ones they tested, only saying that they are "the most popular", personally I don't buy it.
And the information these apps are sending out is primarily geolocation. Well, no ****. If an app wants your location and you don't think it should have it, it's either using it for ads or you should decline to install the app and just send an email to the dev asking him why he needs that information.
Click to expand...
Click to collapse
Agreed... geolocation is pretty obviously straight forward. I don't know about the 'transmissing every 30 seconds' thing though.
Any thoughts ont he transmitting sim card and IMEI info?
http://www.youtube.com/watch?v=qnLujX1Dw4Y
Also discussed here:
http://forum.xda-developers.com/showthread.php?t=795702
With explanation where to get it from http://www.appanalysis.org/
A very well-written reply by "Steven Knox" on The Register, demonstrating how this 'research' is simply a pile of intentionally-misleading statistical rubbish:
By selecting only from applications that access both personal data and the internet, they're overstating the significance of their study by about 3x. Furthermore, their summaries blur this distinction unnecessarily.
Specifically, their FAQ says "We studied just over 8% of the top 50 popular free applications in each category that had access to privacy sensitive information in order to get a sense of the behaviors of these applications." Since there were 22 categories at the time they did the study, that would imply (22*50=1,100 * 8% =) 88 applications. However, they actually only tested 30, because of the 1,100 top 50 applications only (from the PDF) "roughly a third of the applications (358 of the 1,100 applications) require Internet permissions along with permissions to access
either location, camera, or audio data." -- meaning that the other 742 apps don't have the necessary permissions to play badly. The clause "..that had access to privacy sensitive information in order to get a sense of the behaviors of these applications." from the FAQ is grammatically ambiguous in this case (it may refer to "applications" or "category"), and not specific enough to indicate that over 2/3 of the applications are (relatively) safe by dint of not having the necessary permissions.
They also didn't include in their study apps from 10 of the 22 categories, but they don't explain whether that was due to a) there not being any or enough applications in those categories that required internet and personal data permissions, b) a conscious choice to focus on the other 12 categories, or c) the results of random selection (with an explanation of why they did not use a stratified sample).
Once you factor back in the applications they ignored, the numbers don't look quite so bad. Assuming their sample was representative, 2/3 of the 358, or about 239 applications of the top 1,100 of the time use personal data suspiciously. That's about 21.7% or just over 1 in 5 -- still significant, but a far cry from 2 out of 3. In fact, the worst case maximum is actually 358 of 1,100 or just under 1 in 3 (32.45%) because they are as mentioned above the only ones that actually acquire the permissions necessary to do anything "suspicious".
I understand why both the researchers and the reporter used the 2/3 figure -- you all believe you have to sell the point as hard as possible*. But the real story is that it's likely that at least 1 in 5 Android Apps use private data "suspiciously" -- and that number is still high enough to cause concern and to justify the further use of tools like TaintDroid. It's a pity you didn't trust the facts enough to avoid the unnecessary sensationalism.
*I am assuming, here, that Mr. Goodin did actually read and digest the paper as I did, rather than simply picking out the figures from the study, the FAQ, or a press release.
Click to expand...
Click to collapse
good spot. But one in ten woolf be too many. The point is we should have more fine grained control and transparency off what apps do over the net, and we can't, by design.
Sent from my HTC Desire using XDA App
We need to develop a shim that reports modified IMEI/SIM data for different apps. IMO, very few apps need that information. We may not be able to keep all those apps from sending our private information, but we can make that information useless if it appears that we all are using the same IMEI/SIM...
patp said:
...The point is we should have more fine grained control and transparency off what apps do over the net...
Click to expand...
Click to collapse
agreed....
if you are rooted. With Root Explorer go to /data/system/ and open accounts.db you might be surprised what you find in it... Some people it will be fine for but mine it shows my exchange email and password in plain text and a few others show up as plain text has well...Its not geo they are worried about (for the most part) and...this file has been known about for awhile
Don't worry though unless your downloaded android specific virus holding apps you wont have any problem. And if your getting all your apps legally through the market then its no big deal =) and if your pirating them...well I don't feel bad for you...
echoside said:
if you are rooted. With Root Explorer go to /data/system/ and open accounts.db you might be surprised what you find in it... Some people it will be fine for but mine it shows my exchange email and password in plain text and a few others show up as plain text has well...
Click to expand...
Click to collapse
Opened it, my accounts are there, but no passwords....
rori~ said:
Opened it, my accounts are there, but no passwords....
Click to expand...
Click to collapse
my gmail is somesort of encrypted but doesnt look that great.
Exchange shows up
facebook doesnt show anything at all aha
Thats why I said some might not have anything. Awhile back when I first heard about it one of my friends had two or three right there in plain English I didn't have a phone at the time to check...
Its been reported before but kind of just brushed over no biggy. To go real conspiracy theorist....I think apple is submitting all these articles...
ButtonBoy said:
We need to develop a shim that reports modified IMEI/SIM data for different apps.
Click to expand...
Click to collapse
Great idea
The source code/instructions for TaintDroid are now out:
http://appanalysis.org/download.html
Anybody found a (recent) kernel with built-in TaintDroid-support?

Severe security flaw in HTC-sense, sensation affected.!!!

Ran accross this article just now, relized you all had to read this. It appears HTC ****** up hard.
http://www.androidpolice.com/2011/1...e-numbers-gps-sms-emails-addresses-much-more/
Scary stuff.
I'm so damn tired of all companies taking the liberty to just monitor our lifes just how they like, no matter if its google, microsoft, facebook, apple or HTC. What anoyys even more is how we passivly is forced into accepting it, and just shrudd our shoulders about it. Reading this, I wish I was smart enough to strike back somehow.
The article says "Some Sensations" I'd like to know what that means
Good find.
Pikabat said:
The article says "Some Sensations" I'd like to know what that means
Click to expand...
Click to collapse
Try running the app...
errr ok this is scary though. i wanna ask what's htcLaputa.apk is?
Sent from my HTC Sensation XE with Beats Audio using xda premium
The offending app is HtcLogger.apk and I've only seen it in the newer ROMs - I automatically removed it before this story broke as it didn't sound useful. End of the day you just have to be careful when you install new apps (e.g. direct from trusted sources)
I really wouldn't worry too much about it, typical media hype
EddyOS said:
The offending app is HtcLogger.apk and I've only seen it in the newer ROMs - I automatically removed it before this story broke as it didn't sound useful. End of the day you just have to be careful when you install new apps (e.g. direct from trusted sources)
I really wouldn't worry too much about it, typical media hype
Click to expand...
Click to collapse
This is the example of how we/some of us just go used to this kind of things and started to accept things we never would have a few years back.
How exactly do you determine whats a trusted source? Obviously weve already had a bunch of malwares entering the market.
I use apps only from the company in question. 'Facebook for Android' from Facebook, 'Twitter' from Twitter, etc...only use about 20 apps all in anyway so I don't think I'm at risk
I'm not saying what's been found out isn't bad - it is - I just don't really care. People are far too paranoid these days
EddyOS said:
I use apps only from the company in question. 'Facebook for Android' from Facebook, 'Twitter' from Twitter, etc...only use about 20 apps all in anyway so I don't think I'm at risk
I'm not saying what's been found out isn't bad - it is - I just don't really care. People are far too paranoid these days
Click to expand...
Click to collapse
Im not using so much apps either, on the other hand I want to be able to try some "fun" app from androidmarket without fearing theft og my personal information.
Its not about paranoia to me, I couldnt care less about wheter or not some random dude can read my sms. But Im rather angry about the companies doing just as they like, mainly to direct commercials and ads conected to your personality. Did you know facebook, after their latest update, now saves a certain cookie after your logout and sends all urls you visit with your browser back to their server..?
Well, now Im going offtopic in my own thread.
Id like to see HTC comment on this atleast.
Again, if Facebook care if I open a YouTube video every now and then then that's up to them - I'm not interesting!!
Would be nice to see what HTC say but I'm not going to hold my breath!
Im starting to loose faith in htc
Sent from my HTC Sensation 4G using xda premium
I tried to run the app, seems like my Sensation is not affected (Dutch one, that is)
so, in order to gain any kind of advantage, those apps need to know this vulnerability exists, am i right? just deleted that apk file, along with some other ones.
As the Android Police blog appears to have melted, here's Aunty's take on it
http://www.bbc.co.uk/news/technology-15149588
Oh noes naughty people can access:
The list of user accounts, including email addresses (but apparently not usernames or passwords)
A log of recent GPS locations (so you can be stalked!!!!)
Phone numbers taken from recent call logs (so people you call can be stalked!!!)
SMS data, including recent numbers and encoded messages (meh if they want to read "Park 123 543" be my guest)
HTC's response:
"HTC takes our customers' security very seriously, and we are working to investigate this claim as quickly as possible," the company said in a statement.
"We will provide an update as soon as we're able to determine the accuracy of the claim and what steps, if any, need to be taken."
EddyOS said:
The offending app is HtcLogger.apk and I've only seen it in the newer ROMs - I automatically removed it before this story broke as it didn't sound useful. End of the day you just have to be careful when you install new apps (e.g. direct from trusted sources)
I really wouldn't worry too much about it, typical media hype
Click to expand...
Click to collapse
Is there a way to tell if the offending app (Htclogger.apk) is on your phone without rooting?
jggonzalez said:
Is there a way to tell if the offending app (Htclogger.apk) is on your phone without rooting?
Click to expand...
Click to collapse
Remember it appears you are absolutely fine unless you install an app which is written to access the log files.
As Androidpolice says, the info could be used to clone your device, not only read some of your contacts. Now of course, you are fine as long as you do not install any malicious app, but I would even feel uncomfortable knowing that HTC can read ANY activity from my device at ANY point in time WITHOUT asking for my permission (or even after I denied that permission as shown in the video). The VNC thingie would also bug me cuz it is an app without any apparent use for the user and it does not serve a specific purpose - its just there until "someone" needs it. Now of course HTC wants to improve on user feedback and pulling it is much more convenient than asking for it, but if they want my opinion and see what I'm using they should at least ask me for it. That said, let's hope HTC addresses this problem in the very near future and does clarify why those apps are there and what purpose they serve. I will run the test app again after the next OTA for sure.
kwiggington said:
Im starting to loose faith in htc
Sent from my HTC Sensation 4G using xda premium
Click to expand...
Click to collapse
I don't think HTC is the problem.
I believe the problem is Google.
Ever go to the Google Android market place and see what they want to run in the background before they let you in?
I don't go near the place.
majesensei said:
As Androidpolice says, the info could be used to clone your device, not only read some of your contacts. Now of course, you are fine as long as you do not install any malicious app, but I would even feel uncomfortable knowing that HTC can read ANY activity from my device at ANY point in time WITHOUT asking for my permission (or even after I denied that permission as shown in the video).
Click to expand...
Click to collapse
You're misssing the point.
The phone has this feature so that should you enable "Tell HTC" it can then send the info to HTC, if you don't enable that it just sits on your phone as a system log.
xaccers said:
You're misssing the point.
The phone has this feature so that should you enable "Tell HTC" it can then send the info to HTC, if you don't enable that it just sits on your phone as a system log.
Click to expand...
Click to collapse
True, and I agree that this is not a scary thing for itself. I am not a fan of conspiracy theories, but think about a combination of things: The log is created and sits there. There is a VNC client embedded deeply in your system by your manufacturer for no reason, which gives access to your device from a remote location. I am from Germany and used to a debate about data preservation (which is illegal, in Germany), but there are other countries that have a much broader "grey-zone" for these kind of things. I wonder where those Sensations with the HtcLogger.apk are ([email protected]?). We are all running the same Android build (as long as we don't root our phones), some are affected, others aren't. I just find it weird, and I doubt that some rogue dev at HTC programmed these apk's just for the fun of it.

Anyone playing with On{x}

Has anyone tried Microsofts answer to tasker?
Sent from my HTC One X using xda premium
JamesR913 said:
Has anyone tried Microsofts answer to tasker?
Sent from my HTC One X using xda premium
Click to expand...
Click to collapse
Do not understand?
You talking about an app?
From Microsoft? You think they be busy with the WM thing? (which I care less about)
Yes it is an app that is similar to tasker. You program it on the website and then install the app and it automates certain things. As of right now it is only available on Android
Sent from my HTC One X using xda premium
I'll check it out because apparently I'm too stupid to use Tasker.
I tried to figure it out but I got lost.
Apparently, users hate it so far. The app requires your Facebook login, which is ridiculous. Its also being speculated that the app is farming data about your behavior through this app, and passing it to Faacebook.
http://betanews.com/2012/06/06/microsoft-gives-back-to-android-but-users-say-no-thanks/
Link to the app on the Play Store:
https://play.google.com/store/apps/details?id=com.microsoft.onx.app
Hmmmm
redpoint73 said:
Apparently, users hate it so far. The app requires your Facebook login, which is ridiculous. Its also being speculated that the app is farming data about your behavior through this app, and passing it to Faacebook.
http://betanews.com/2012/06/06/microsoft-gives-back-to-android-but-users-say-no-thanks/
Link to the app on the Play Store:
https://play.google.com/store/apps/details?id=com.microsoft.onx.app
Click to expand...
Click to collapse
I see a lot of the bad reviews seem to be about the facebook login, didnt see much about the actual product. Did not see much about the farming data and such.
I actually think this is a good idea. Facebook is a solid method of identification, and can be used cross platform. It may be true microsoft is giving an android exclusive (temporarily) as a beta test. When/if they roll it out to microsoft/apple phones they would not have to change their authentication model. It would be ridiculous to request "Live" for windows phones, "Apple ID" for iphones, and google ID for android users. This simplifies the process and allows me to change phones easier. I am not a fb advocate, in fact I personally dont like logging in to sites and such using my fb page, but as I said I do understand it. Clearly the fb authentification is respected, if the New York legislature thinks it should be required to comment on any webpage
http://www.wired.com/threatlevel/2012/05/anonymous-online-speech-ban/
(Not getting into a political debate lol but the facebook model "works").
EDIT: I do not use tasker and am not an experienced android user, but I may try this out and attempt to give feedback.
gunnyman said:
I'll check it out because apparently I'm too stupid to use Tasker.
I tried to figure it out but I got lost.
Click to expand...
Click to collapse
Tasker is actually pretty simple to use, once you understand what its asking for.
Forexample lets make a program that silences your Ringer, Turns off WiFi and Bluetooth every Mon-Fri 8:30am - 3:30pm (Work day).
First, it asks you for the Profile Name, This is just something to identify the task. Lets call this Work.
Next it asks you for the "First Context" This can be considered your first "Variable" for us we want it to be Monday thru Friday. So we click "day"
then Change the "Month" to "Week Day", and Select Mon-Friday.
Click the Green Check mark.
Now it asks for a Task. This is what you want to do, so click New Task: And Name it, lets name it "Vibrate,Wifi,BT"
Now we can click the Plus in the bottom right and it brings up a menu of all the possible things we can mess with. For this instance, lets click Audio, then Silent mode. Now we want Silent mode to turn on, so change the "mode" to On click the Check mark
Now Click the plus, to add wifi and Bt off. Then click the Check mark.
Now to add the time, click and hold on your context, then click add. Now you can add "time" and set your times.
All Done.
That was an example of a simple program. Tasker can do a lot more, so explore and test
gunnyman said:
I'll check it out because apparently I'm too stupid to use Tasker.
I tried to figure it out but I got lost.
Click to expand...
Click to collapse
I agree. Tasker is WAY to involved to try and set up the simplest of tasks. I played with it for about an hour and uninstalled it.
Tasker is the best app I've ever owned. It's simple to set up if you just stop and look at what each thing is.
I started playing around with this today, had a few interesting ideas but there are still quite a few issues and limited api usage available.
This could be a pretty powerful tool if they open up the api's, easier for most than tasker, and can be as complex as you can code.
also i prefer to do all my programming on the pc and transfer to the device which on{x} provides.
Never used tasker so can't compare. But, onx seem fine so far if you like to get your hands dirty in JavaScript. You can still use published recepies if you are no into coding. It is still very buggy and consumes a lot of battery juice.
Sent from my HTC One X using XDA
Good thing with Tasker is that it doesn't require any programming knowledge. This obviously requires knowledge of javascript to get the full potential.

[Q] Privacy issues with Google Now

If you have recently tried to update your Google Now, you may have seen the new requested permissions. These include, but are not limited to, access to your phone's microphone at any time without your permission, and access to your phone's camera (assuming front-facing and rear) at any time without your permission.
Questions: Why is Google attempting to completely dissolve any sort of privacy in order to use Google Now? It is a handy tool, but is a slap in the face in the "all-or-nothing" permission request it puts forth. This is incendiary and needs to be stopped. Google does not need the ability to see and hear me in the privacy of my home.
Followup - Is this something that can be circumvented by an application, or baked into the ROM's our dev's make? Is there any way that the tech geniuses here at XDA can fight the good fight in this struggle for end-user privacy?
Is anyone else creeped out by this???
Pdroid?
Pffffffffffffffffffftt.
R3CKL355 said:
Pdroid?
Pffffffffffffffffffftt.
Click to expand...
Click to collapse
+1 - I won't run any ROM without pdroid - it requires a lot of effort up front, but is entirely worth it and it's an excellent way to learn how to secure your device. You'll be amazed at the unnecessary access some apps can get by default.
The Feds (Google counts as part since they operate under them) could always do that since the 90s even with the phone off. It was always denied but now it's just out in the open kinda how your blood was stored in data banks at birth since the 60s and it was denied by the government until Mr. George w. Bush said they can do it legally. Nothing to be creeped out by, just have a few weapons and lots of ammo ready.
Sent from the Matrix
---------- Post added at 06:49 PM ---------- Previous post was at 06:43 PM ----------
http://abcnews.go.com/blogs/headlines/2006/12/can_you_hear_me/
http://www.childrenscolorado.org/wellness/info/parents/23018.aspx
Sent from the Matrix
I imagine the microphone at all times might be for a future release so you can say 'google' at any time and the search box will come up, which would be pretty sweet. Not sure about the camera though. I ended up disabling now because the maps process took too much battery for how little I used the service.
That's creepy, but I guess that's the price we pay for Google's "free" services because nothing is really free. The only way to stop is not using it.
I always get paranoid with these types of services. Havent even tried Google Now since getting it in the OTA JB update. The whole idea about it tracking you, learning your preferences to suggest you search results, etc. Just seems a little spooky.
Please read forum rules before posting
Questions go in Q&A
Thread moved
Thank you for your cooperation
Friendly Neighborhood Moderator
Best advice: Get a dumb phone, don't use Google or any search engine on your home computer...the list is endless....
So, I got a PDroid compatible ROM. The interface isn't that intuitive to me. Can someone tell me what the different icons mean?
Clearly the green check mark means that this particular permission has been granted, and the circle/slash means blocked. What about the "?" and "AB"?
When would one use "Notify on access" or "Log access"?
What's the difference between Save, X, and Trash?
Are we suppose to be suprised that an app that has the capability to run our entire phone by voice and predict our movement and actions has permission to access all our movements and actions?
If privacy is an issue, you either shouldn't use it or at the least use PDroid. But that's Google MO, they give you convenience at the price of your privacy.
I believe "?' means there are no settings for that app in place yet. I forget what AB is. There should be a legend somewhere in there? *currently on a ROM without PDroid so I cant look it up*
corbn89 said:
Are we suppose to be suprised that an app that has the capability to run our entire phone by voice and predict our movement and actions has permission to access all our movements and actions?
If privacy is an issue, you either shouldn't use it or at the least use PDroid. But that's Google MO, they give you convenience at the price of your privacy.
I believe "?' means there are no settings for that app in place yet. I forget what AB is. There should be a legend somewhere in there? *currently on a ROM without PDroid so I cant look it up*
Click to expand...
Click to collapse
Lol... Internet tough guy. Are we to assume Google Now needs video and or audio feed to tell me what time I leave for work? I'm no oracle, but that answer, corbn89, is a resounding NO. Thanks for your relevant post. Pfft...
Replying to my useless post (considering my info was wrong) with another useless post. Real classy.
Anyways, did you find out what AB was?
The options in PDroid 2.0 are allow, deny, prompt when asking for permission. Prompting would be used with an app where you wouldn't want to allow it all the time but spoofing your info may result unwanted results (e.g. locations)
AB appears to be a spoofing mechanism as it allows for a new value to be inputted by the user. For instance, when I go into the FB app and click on the AB next to Phone Number, it allows another string to enter (I entered a viable fake number). However, it appears that ANY change to permissions renders the application (FB in this case) unusable as it will FC before it even opens. Any change to permissions automatically defaults the app to be labeled as "Untrusted". I have not been able to get PDroid functional at all. Any ideas???
If you don't like it, don't use it. Obviously, they aren't going to "spy" on you with your camera and mic. What a joke.
Sent from my SCH-I535 using XDA Premium HD app

Categories

Resources