News for hackers. Stuff that matters.

A comment on Beware of ads that use inaudible sound to link your phone, TV, tablet, and PC. Parent comment

Re:Beware of ads that use inaudible sound to link your phone... by CountSessine on Friday November 13, 2015 @06:02PM (#10562984)
I wonder. If an Android app sticks to api level 22, then presumably they can continue demanding those permissions without having them denied, even on Android 6.0, no?

There are already apps that let you re-write a side-loaded app's permissions, but that usually doesn't work very well. I tried re-writing Facebook's permissions and it aborts fairly quickly.

[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by JohnTHaller on Friday November 13, 2015 @06:24PM (#10563116)
They can. But you can then enter Options and turn those specific permissions off. Apps like that get fake data, like an empty contact list or that the device doesn't have GPS present/turned on.
[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by CountSessine on Friday November 13, 2015 @07:03PM (#10563415)
That's how cyanogen works, but Google will never do that. The howtogeek.com link that someone else here posted confirms this - apps will just fail and you'll be stuck restoring the permission.
[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by x1798DE on Friday November 13, 2015 @07:31PM (#10563575)
Well, you'll restore the permission if you want to use that app, but if you disable microphone permissions and the app breaks for no reason, do you really want to keep using that app?
[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by JoshTriplett on Friday November 13, 2015 @08:14PM (#10563811)
Exactly. An app like Netflix couldn't get away with that; if it started breaking, people would contact Netflix support, and if the answer was "turn on the microphone", people would demand a reason why it needs to have access all the time.
[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by CountSessine on Friday November 13, 2015 @11:37PM (#10564483)
I completely agree with you that we shouldn't be using applications that demand more permissions than are obviously needed, but...

...the top 10 flashlight apps in the Play store require network access, camera access, address book access, etc. I can't believe that there would be any great complaint among the majority of android users if Netflix asked for microphone access. And that's exactly why we need the ios-style permissions that google is finally bringing to android.

[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by JoshTriplett on Friday November 13, 2015 @11:56PM (#10564524)
If you mean flashlight apps that use the flash LEDs, that explains why they need camera access. Address book is ridiculous, though.

As for people complaining: a few recent upgrades of Google applications asked for additional permissions without explanation, and the "reviews" of those got inundated with comments complaining and asking about those additional permissions until Google gave a satisfactory explanation (Chromecast support).

[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by babuskov on Saturday November 14, 2015 @01:29AM (#10564736)
That's correct. I built a minimal flashlight app and camera is the only privilege it needs:

https://play.google.com/store/apps/details?id=com.bigosaur.l...

[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by JohnTHaller on Saturday November 14, 2015 @01:58AM (#10564787)
They should only need Camera access. Or, if they're built to the new Android 6.0 APIs, they can use setTorchMode which is even better.

http://developer.android.com/reference/android/hardware/came...

Granted, they're unnecessary now because flashlight on/off is in the pulldown.

[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by kevin_thibedeau on Saturday November 14, 2015 @02:57PM (#10566987)
There is still the nuisance that the camera is activated for the torch mode and the autofocus hardware is audible on some phones.
[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by JohnTHaller on Monday November 16, 2015 @09:52AM (#10574700)
That's really more the fault of the phone manufacturer than of Android, though. Most likely, the camera firmware and binary blob driver aren't distinguishing the calls.
[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by CountSessine on Friday November 13, 2015 @07:36PM (#10563607)
Agreed.
[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by T-A on Friday November 13, 2015 @06:20PM (#10563084)
http://www.howtogeek.com/230683/how-to-manage-app-permission...
[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by CountSessine on Friday November 13, 2015 @07:04PM (#10563419)
When revoking permissions from older applications, you’ll see a warning message saying, “This app was designed for an older version of Android. Denying permission may cause it to no longer function as intended."

Older applications weren’t designed for this feature, and they generally just assume they have access to any permissions they request. Most of the time, applications should just continue working normally if you revoke their permissions. In some rare cases, the application may crash — if it does, you’ll need to give it permission again.

So yeah, if Facebook decides to stick to api level 22 for a while, you won't be able to un-privilege it.

[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by what_ever on Friday November 13, 2015 @07:32PM (#10563579)
I know you are giving Facebook as just an example but they have updated their app. If any well known app company continues to do this you can assume they are avoiding/delaying the API update to get more of your data and you should stop using them if you can.
[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by digi_owl on Saturday November 14, 2015 @02:11AM (#10564821)
My Huawei P6 (yep, a Chinese company providing user selectable privacy options) shipped with some variant of this, and i have yet to see anything break when using it.
[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by mtgx on Saturday November 14, 2015 @02:37AM (#10564872)
Facebook will likely be one of the worst offenders for this. That's why Google may need to enforce the new permission model as soon as Android 7.0.
[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by izacus on Saturday November 14, 2015 @03:53AM (#10565009)
Facebook already updated their app.
[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by dethstar on Friday November 13, 2015 @06:10PM (#10563029)
I guess it depends how they worked it in. Is it in the app permission requesting code? Then yeah, app would need to upgrade their api level. Is it on the OS level, and they'll do something like just give null/useless data when you deny the permisson? Then it wouldn't matter.
[ Parent | on HN ]
Re:Beware of ads that use inaudible sound to link your phone... by CountSessine on Friday November 13, 2015 @07:07PM (#10563435)
That's how cyanogen does it - empty address book, camera that always takes black pictures, etc. But I didn't think that Google would ever do that, and @T-A's link to howtogeek.com seems to confirm this. The app will fail on api calls that previously worked and you'll be stuck restoring the permissions.
[ Parent | on HN ]