News for hackers. Stuff that matters.
Re:Beware of ads that use inaudible sound to link your phone... by JoshTriplett on Friday November 13, 2015 @05:46PM (#10562887)
One of many reasons I find it amazing that applications ask for permission to the microphone when they don't have a good reason.

The latest Netflix update on Android asks for microphone permissions, saying that in the future they'll offer a way to call Netflix support from within the app. No, that's not a good reason; I have a phone for that. I've specifically avoided that upgrade; I'm hoping that my Nexus gets the upgrade to M before then, so that I can upgrade Netflix but deny it access to the microphone.

Re:Beware of ads that use inaudible sound to link your phone... by danepowell on Friday November 13, 2015 @05:57PM (#10562951)
This is why on-demand permissions are one of the best features of Android 6.0. Don't want Netflix to access your microphone? No problem--don't let it.
Re:Beware of ads that use inaudible sound to link your phone... by lucb1e on Friday November 13, 2015 @06:53PM (#10563361)
Got this via Cyanogenmod already on 4.4 and I use it all the time.

Not just for permissions by the way, Privacy Guard can also prevent wake locks and auto start permissions. That's a serious battery life saver.

Re:Beware of ads that use inaudible sound to link your phone... by eklavya on Saturday November 14, 2015 @12:27PM (#10566430)
I used to believe that and installed CM 12.1 on my phone only to find out that the restrictions don't really work. Whatsapp was able to read my messages (automatic phone verify) when I had disabled the access. Digging around I found out this is the case even with XPrivacy (there are open issues on github) which is supposed to be more extensive. There are some situations when the blocks aren't enforced at all (like some native calls). I got a nexus 5x, android 6 permissions feature actually works.
Re:Beware of ads that use inaudible sound to link your phone... by kachnuv_ocasek on Saturday November 14, 2015 @03:19AM (#10564933)
I use this extensively myself, but the one problem that I'm facing is that it makes some applications unstable. Usually, I just uninstall them as I'd rather sacrifice my comfort than my security and privacy.
Re:Beware of ads that use inaudible sound to link your phone... by barbs on Saturday November 14, 2015 @12:11AM (#10564566)
Thanks for this, I didn't realise you could do this in CM. You can also check when the permissions were being used. For the Netflix app I noticed the "record audio" permission had never been used, but I've set it to explicitly ask me if it tries to use it.
Re:Beware of ads that use inaudible sound to link your phone... by modeless on Saturday November 14, 2015 @03:41AM (#10564979)
Android 6.0 does those things for you too. (Doze and App Standby)
Re:Beware of ads that use inaudible sound to link your phone... by conceit on Sunday November 15, 2015 @03:59AM (#10568990)
sounds like cm is used as a testing channel for new features.
Re:Beware of ads that use inaudible sound to link your phone... by tgb on Friday November 13, 2015 @06:06PM (#10563008)
Does it also allow a "popup request for each use" option? Seems like the right option for the Netflix hotline support feature.
Re:Beware of ads that use inaudible sound to link your phone... by aiiane on Friday November 13, 2015 @06:44PM (#10563289)
No, but you can go into the phone settings and re-enable a permission for an app if you change your mind.
Re:Beware of ads that use inaudible sound to link your phone... by pki on Friday November 13, 2015 @10:52PM (#10564360)
Aren't privacyguard's actions Ask / Never / Always?
Re:Beware of ads that use inaudible sound to link your phone... by andrewaylett on Saturday November 14, 2015 @04:45AM (#10565111)
Most of them, yes. There are a couple that are just on/off, like wake locks.
Re:Beware of ads that use inaudible sound to link your phone... by digi_owl on Saturday November 14, 2015 @02:02AM (#10564792)
Just sad that Google has lumped the permissions into categories, and also put a bunch of them into "safe".

Yeah yeah, clueless aunt Tillie will flip something and complain that its broken. But persisting this way means that you (Google and anyone agreeing with their stance) are breeding whole generations of Tillies.

Re:Beware of ads that use inaudible sound to link your phone... by emsy on Saturday November 14, 2015 @04:11AM (#10565047)
iOS has this for years without a problem, so Google has to find a better reason why they screwed this up for so long.
Re:Beware of ads that use inaudible sound to link your phone... by nitrogen on Saturday November 14, 2015 @12:41PM (#10566491)
And before iOS, J2ME phones had very fine-grained permissions (though it was usually the carrier that controlled them).
Re:Beware of ads that use inaudible sound to link your phone... by digi_owl on Sunday November 15, 2015 @03:42AM (#10568961)
Depends on where in the world you lived...
Re:Beware of ads that use inaudible sound to link your phone... by mtgx on Saturday November 14, 2015 @02:36AM (#10564868)
Indeed. Six categories seems like a pretty small number.
Re:Beware of ads that use inaudible sound to link your phone... by gedrap on Saturday November 14, 2015 @01:04PM (#10566563)
FirefoxOS (I was using v1.3, not sure about earlier or later versions) did the same, it was pretty neat. It's really nice that they are doing it from the very early days, not waiting for their app marketplace to become bigger.
Re:Beware of ads that use inaudible sound to link your phone... by maccard on Friday November 13, 2015 @06:06PM (#10563009)
And remember. iOS has had this since its inception
Re:Beware of ads that use inaudible sound to link your phone... by JohnTHaller on Friday November 13, 2015 @06:23PM (#10563099)
No, it didn't. iOS originally gave apps access to just about everything except background execution without any warning. At the time Android had the superior permissions model, with each app telling you what it needed at install and you being in control of whether or not you wanted to install it with that information. Older iOS apps had access to your photos, your contacts, and other stuff and could use it with no warning to you.

As a result of early privacy breaches, later releases of iOS added per-function permissions on demand, leap-frogging Android in terms of permissions functionality. Android has had some level of per-function permissions on demand in the works since Android 4.4 -- and you could use it in unofficial Android builds like CyanogenMod by turning off individual permissions for apps -- but the feature only finally made it into official builds in Android 6.0. It also got it properly in the API and manifest of apps as well so they can ask permissions as they need them... like the Facebook app needing access to your photos when you select to attach a photo to a post.

Re:Beware of ads that use inaudible sound to link your phone... by fredrik-j on Saturday November 14, 2015 @04:09AM (#10565041)
I have to add that the Facebook app does not have to have or ask for any permission at all to let the user pick an image to publish in their stream. It can use Android Intents to delegate to the user's choice of image picker app to do that[0].

The Intent system[1] is the real ingenuity of the original Android platform. I wish it was used more. Unfortunately most apps choose to implement things like picking an image or an address from the address book in their own code instead - thus more or less forcing the user to submit excessive permissions to the app to get anything done - rather than using the intent system.

The 6.0 on demand permissions may be a decent step forward from the old way of forcing the user to hand over all permissions at install time. Even better would be if the user could indicate to the app that it should use an intent based solution instead requesting a certain permission.

Obviously there are exceptions to this, some tasks require permissions and cannot be resolved with intents.

[0] http://stackoverflow.com/questions/5309190/android-pick-imag... [1] https://developer.android.com/guide/components/intents-filte...

Re:Beware of ads that use inaudible sound to link your phone... by threeseed on Saturday November 14, 2015 @02:14AM (#10564828)
Apple started adding location services permissions 5 years ago. Android 6.0 has only just been released.

Whichever way you look at it it's pretty unacceptable that it's taken so long for Android to implement this.

Re:Beware of ads that use inaudible sound to link your phone... by yareally on Saturday November 14, 2015 @03:12AM (#10564922)
> "Apple started adding location services permissions 5 years ago. Android 6.0 has only just been released".

Location permissions have been in Android since the version 1.0 of the API.

http://developer.android.com/reference/android/Manifest.perm...

Re:Beware of ads that use inaudible sound to link your phone... by threeseed on Saturday November 14, 2015 @03:49AM (#10565004)
But that is the permissions that only appear when you download the app from the store.

I am talking about the API permissions e.g. "the dialog box that pops up confirming you want to allow this app to read your location".

That is the point of this whole discussion right ?

Re:Beware of ads that use inaudible sound to link your phone... by geofft on Friday November 13, 2015 @07:12PM (#10563474)
As of iOS 5, contacts were stored in a world-writable SQLite database. An app that corrupted this database would break contacts for all apps, causing some apps to crash or misbehave, and no permissions were required. (I ran across this on my personal iPad on an app I was developing, after a fit of overconfidence regarding SQLite encryption and whitelisting vs. blacklisting.)
Re:Beware of ads that use inaudible sound to link your phone... by rogerbinns on Friday November 13, 2015 @06:17PM (#10563070)
BlackBerry had it too. There was a tree of permissions (broad categories at the top, specifics in the leaves) and you could set permissions to deny, allow or ask each time.
Re:Beware of ads that use inaudible sound to link your phone... by kalleboo on Friday November 13, 2015 @06:25PM (#10563132)
And remember. Java/J2ME phones had this since their inception.
Re:Beware of ads that use inaudible sound to link your phone... by xnzakg on Friday November 13, 2015 @07:09PM (#10563452)
Java phones even supported asking for internet access... which is pretty much taken for granted now, and GPlay doesn't even show that an app needs it.
Re:Beware of ads that use inaudible sound to link your phone... by barrkel on Saturday November 14, 2015 @02:22AM (#10564849)
If you could deny access to an application with no good intrinsic reason to go online (eg single player game) then you would probably block ads too, and that's not in Google's interest.
Re:Beware of ads that use inaudible sound to link your phone... by ATsch on Saturday November 14, 2015 @05:52AM (#10565250)
For HTTP requests, yes. Using sockets requires the "Full network permissions" permission.
Re:Beware of ads that use inaudible sound to link your phone... by tormeh on Friday November 13, 2015 @09:40PM (#10564172)
I was behind the curve on smartphones for a long time. Luckily my dumbphone had 3G and Java, so I had Google Maps and Facebook on my dumbphone... with multitasking! Slow as hell, but the dumbphone=>smartphone transition was more gradual than most people realize - It was mostly about better UI and hardware; the basic software was already there.
Re:Beware of ads that use inaudible sound to link your phone... by digi_owl on Saturday November 14, 2015 @02:07AM (#10564806)
Frankly many "dumbphones" could rival iPhone when it launched, yet the press went gaga about smartphone for the masses (because Apple made it, natch).

The basic problem was that USA was lagging the mobile world severely, so when the likes of iPhone shipped over there it seemed like a revolution for that insular market. I just wish the wider (tech) press didn't so much unquestionably parrot the US press.

Re:Beware of ads that use inaudible sound to link your phone... by masklinn on Saturday November 14, 2015 @08:27AM (#10565581)
> Frankly many "dumbphones" could rival iPhone when it launched

Did you live through these? I used most of the pre-iPhone Nokia S40 smartphones and owned a few of them, both "consumer" N-series and "professional" E-series. They only rivaled iphones in the checkbox sense: features were technically present on the phone, anything beyond that was missing, the hardware was usually insufficient, the software was garbage on both usability and performances, the overall experience was utterly miserable. After I finally switched from my E70 to a 3G the only thing I wondered is why I hadn't switched earlier (answer being I didn't want to lose the checkbox of 3G support, never mind that I'd have had more utility from 2G on an iphone than I did from 3G on an E70).

And dumbphones didn't come close (dumbphones were what non-corp US users used).

Re:Beware of ads that use inaudible sound to link your phone... by digi_owl on Sunday November 15, 2015 @03:42AM (#10568960)
Still own a SE C702, and it has served me well.
Re:Beware of ads that use inaudible sound to link your phone... by eropple on Saturday November 14, 2015 @03:28AM (#10564953)
> because Apple made it, natch

Or because it just plain felt better to use and was available on a heretofore unprecedented scale among people who shape public opinion. But that doesn't allow one to impute some kind of invalidity to the occurrence, does it?

Re:Beware of ads that use inaudible sound to link your phone... by duaneb on Saturday November 14, 2015 @03:54AM (#10565012)
I mean any phone can rival the iphone. It's also not hard to see that the mobile browsers at the time were utterly miserable to use. Touch was only a part of it.
Re:Beware of ads that use inaudible sound to link your phone... by SixSigma on Saturday November 14, 2015 @03:03AM (#10564908)
People quickly forget that the iPhone didn't have the appstore at launch. It was an ipod with browser, maps, email, sms and a phone.

I think the real innovation was the data contract, getting a decent data allowance for other phones was for Rockerfella.

Re:Beware of ads that use inaudible sound to link your phone... by Eldarrion on Friday November 13, 2015 @06:24PM (#10563121)
And then they waited until 3GS to have multimedia messaging. Let's not argue the benefits of one OS over another and derail the discussion into a fan service announcement.
Re:Beware of ads that use inaudible sound to link your phone... by digi_owl on Saturday November 14, 2015 @02:09AM (#10564815)
And today will silently redirect messaging onto their own system, that will swallow any incoming messages if you ever dear leave their ecosystem. I really really wish they had never gotten into the phone business.
Re:Beware of ads that use inaudible sound to link your phone... by voltagex_ on Saturday November 14, 2015 @02:48AM (#10564887)
I dislike some of Apple's actions too, but let's remain factual. http://arstechnica.com/apple/2014/11/new-apple-support-page-...
Re:Beware of ads that use inaudible sound to link your phone... by Johnny555 on Friday November 13, 2015 @06:37PM (#10563224)
Having to call or chat support is the worst thing about Netflix support, most of the time I don't want to talk with someone on the phone about my problem and resolve it in realtime, I just want to send them an email, explain the issue, and then they can email me back in 24 hours.

I haven't tried their Chat support, but I assume it's like all of the other chat services where agents handle many customers at a time so it takes forever for each response back.

Re:Beware of ads that use inaudible sound to link your phone... by joshribakoff on Saturday November 14, 2015 @01:15PM (#10566596)
I tried their chat support, they were very outgoing, personable & solved my problem almost immediately. If they were helping other people at the same time, I certainly didn't notice.
Re:Beware of ads that use inaudible sound to link your phone... by bhauer on Friday November 13, 2015 @08:10PM (#10563785)
Windows 10 (desktop, tablet, mobile, all flavors) needs fine-grained permissions that can be granted and revoked in a similar manner. Even traditional desktop apps need to have similar sandboxing features.
Re:Beware of ads that use inaudible sound to link your phone... by semi-extrinsic on Saturday November 14, 2015 @03:16AM (#10564927)
But on Windows, stuff like the "Install->Next->Next->Next->Next->I agree->Next->Waaait for it->Next->Finish" dance has conditioned everyone but the security zealots to click "Yes" without even reading the dialog box. I've seen people with twitch-gamer like reflexes for accepting Windows prompts.
Re:Beware of ads that use inaudible sound to link your phone... by CountSessine on Friday November 13, 2015 @06:02PM (#10562984)
I wonder. If an Android app sticks to api level 22, then presumably they can continue demanding those permissions without having them denied, even on Android 6.0, no?

There are already apps that let you re-write a side-loaded app's permissions, but that usually doesn't work very well. I tried re-writing Facebook's permissions and it aborts fairly quickly.

Re:Beware of ads that use inaudible sound to link your phone... by JohnTHaller on Friday November 13, 2015 @06:24PM (#10563116)
They can. But you can then enter Options and turn those specific permissions off. Apps like that get fake data, like an empty contact list or that the device doesn't have GPS present/turned on.
Re:Beware of ads that use inaudible sound to link your phone... by CountSessine on Friday November 13, 2015 @07:03PM (#10563415)
That's how cyanogen works, but Google will never do that. The howtogeek.com link that someone else here posted confirms this - apps will just fail and you'll be stuck restoring the permission.
Re:Beware of ads that use inaudible sound to link your phone... by x1798DE on Friday November 13, 2015 @07:31PM (#10563575)
Well, you'll restore the permission if you want to use that app, but if you disable microphone permissions and the app breaks for no reason, do you really want to keep using that app?
Re:Beware of ads that use inaudible sound to link your phone... by JoshTriplett on Friday November 13, 2015 @08:14PM (#10563811)
Exactly. An app like Netflix couldn't get away with that; if it started breaking, people would contact Netflix support, and if the answer was "turn on the microphone", people would demand a reason why it needs to have access all the time.
Re:Beware of ads that use inaudible sound to link your phone... by CountSessine on Friday November 13, 2015 @11:37PM (#10564483)
I completely agree with you that we shouldn't be using applications that demand more permissions than are obviously needed, but...

...the top 10 flashlight apps in the Play store require network access, camera access, address book access, etc. I can't believe that there would be any great complaint among the majority of android users if Netflix asked for microphone access. And that's exactly why we need the ios-style permissions that google is finally bringing to android.

Re:Beware of ads that use inaudible sound to link your phone... by JoshTriplett on Friday November 13, 2015 @11:56PM (#10564524)
If you mean flashlight apps that use the flash LEDs, that explains why they need camera access. Address book is ridiculous, though.

As for people complaining: a few recent upgrades of Google applications asked for additional permissions without explanation, and the "reviews" of those got inundated with comments complaining and asking about those additional permissions until Google gave a satisfactory explanation (Chromecast support).

Re:Beware of ads that use inaudible sound to link your phone... by babuskov on Saturday November 14, 2015 @01:29AM (#10564736)
That's correct. I built a minimal flashlight app and camera is the only privilege it needs:

https://play.google.com/store/apps/details?id=com.bigosaur.l...

Re:Beware of ads that use inaudible sound to link your phone... by JohnTHaller on Saturday November 14, 2015 @01:58AM (#10564787)
They should only need Camera access. Or, if they're built to the new Android 6.0 APIs, they can use setTorchMode which is even better.

http://developer.android.com/reference/android/hardware/came...

Granted, they're unnecessary now because flashlight on/off is in the pulldown.

Re:Beware of ads that use inaudible sound to link your phone... by kevin_thibedeau on Saturday November 14, 2015 @02:57PM (#10566987)
There is still the nuisance that the camera is activated for the torch mode and the autofocus hardware is audible on some phones.
Re:Beware of ads that use inaudible sound to link your phone... by JohnTHaller on Monday November 16, 2015 @09:52AM (#10574700)
That's really more the fault of the phone manufacturer than of Android, though. Most likely, the camera firmware and binary blob driver aren't distinguishing the calls.
Re:Beware of ads that use inaudible sound to link your phone... by CountSessine on Friday November 13, 2015 @07:36PM (#10563607)
Agreed.
Re:Beware of ads that use inaudible sound to link your phone... by T-A on Friday November 13, 2015 @06:20PM (#10563084)
Re:Beware of ads that use inaudible sound to link your phone... by CountSessine on Friday November 13, 2015 @07:04PM (#10563419)
When revoking permissions from older applications, you’ll see a warning message saying, “This app was designed for an older version of Android. Denying permission may cause it to no longer function as intended."

Older applications weren’t designed for this feature, and they generally just assume they have access to any permissions they request. Most of the time, applications should just continue working normally if you revoke their permissions. In some rare cases, the application may crash — if it does, you’ll need to give it permission again.

So yeah, if Facebook decides to stick to api level 22 for a while, you won't be able to un-privilege it.

Re:Beware of ads that use inaudible sound to link your phone... by what_ever on Friday November 13, 2015 @07:32PM (#10563579)
I know you are giving Facebook as just an example but they have updated their app. If any well known app company continues to do this you can assume they are avoiding/delaying the API update to get more of your data and you should stop using them if you can.
Re:Beware of ads that use inaudible sound to link your phone... by digi_owl on Saturday November 14, 2015 @02:11AM (#10564821)
My Huawei P6 (yep, a Chinese company providing user selectable privacy options) shipped with some variant of this, and i have yet to see anything break when using it.
Re:Beware of ads that use inaudible sound to link your phone... by mtgx on Saturday November 14, 2015 @02:37AM (#10564872)
Facebook will likely be one of the worst offenders for this. That's why Google may need to enforce the new permission model as soon as Android 7.0.
Re:Beware of ads that use inaudible sound to link your phone... by izacus on Saturday November 14, 2015 @03:53AM (#10565009)
Facebook already updated their app.
Re:Beware of ads that use inaudible sound to link your phone... by dethstar on Friday November 13, 2015 @06:10PM (#10563029)
I guess it depends how they worked it in. Is it in the app permission requesting code? Then yeah, app would need to upgrade their api level. Is it on the OS level, and they'll do something like just give null/useless data when you deny the permisson? Then it wouldn't matter.
Re:Beware of ads that use inaudible sound to link your phone... by CountSessine on Friday November 13, 2015 @07:07PM (#10563435)
That's how cyanogen does it - empty address book, camera that always takes black pictures, etc. But I didn't think that Google would ever do that, and @T-A's link to howtogeek.com seems to confirm this. The app will fail on api calls that previously worked and you'll be stuck restoring the permissions.
Re:Beware of ads that use inaudible sound to link your phone... by OJFord on Friday November 13, 2015 @05:58PM (#10562957)

    > I've specifically avoided that upgrade; I'm hoping that
    > my Nexus gets the upgrade to M before then, so that I
    > can upgrade Netflix but deny it access to the
    > microphone.
Weird - mine stopped working when the upgrade became available; until I reluctantly installed it.
Re:Beware of ads that use inaudible sound to link your phone... by blazespin on Friday November 13, 2015 @07:33PM (#10563586)
Hmm I wonder if there is a way to test if netflix is using the technology. Maybe play the audio sound and check the processor usage or connect to the process and track the syscalls.
Re:Beware of ads that use inaudible sound to link your phone... by Kiro on Saturday November 14, 2015 @03:44AM (#10564992)
Just because you allow microphone access does it really mean they can listen to it without you being aware?
Re:Beware of ads that use inaudible sound to link your phone... by SeanDav on Saturday November 14, 2015 @04:11AM (#10565048)
Yes - exactly that.
Re:Beware of ads that use inaudible sound to link your phone... by raverbashing on Friday November 13, 2015 @06:18PM (#10563075)
Yeah, coarse-grained permissions are complicated

Sometimes they need it for only one feature. But in this case it could ask for permission for only a specific task, but since this functionality is not present (I think IOS allows on-demand permissions) it must be asked "for ever"

Re:Beware of ads that use inaudible sound to link your phone... by gene-h on Friday November 13, 2015 @07:08PM (#10563446)
So can you prevent javascript in the browser from accessing android sensors without permission now?
Re:Beware of ads that use inaudible sound to link your phone... by CamperBob2 on Friday November 13, 2015 @07:07PM (#10563440)
The latest Netflix update on Android asks for microphone permissions, saying that in the future they'll offer a way to call Netflix support from within the app.

Seriously? Because that kind of overt lie would cross the line into outright evil.

"Call Netflix support?" Really? How stupid would someone have to be to buy that?