News for hackers. Stuff that matters.
Re:More Android phones than ever are covertly listening for ... by izacus on Saturday May 06, 2017 @01:41PM (#14281400)
ArsTechnica unfortunately again misleads people due to limited expertise.

On modern Androids (6.0+) accessing the microphone requires an explicit permission granted by user (just like on iOS). Furthermore, due to Doze mode implemented in 6.0 and expanded in 7.0 running these kind of services without notifying the user cleary (with permanent notification) has become pretty much impossible and unreliable. To run in background when the phone isn't in active use the service needs to be marked "Foreground" which demands a permanent notification.

Having said that - Google is failing here in several ways. First, they STILL let apps be published that don't target Android 6.0. Apps that target older Androids get permissions granted at install time (those can be revoked, but user needs to go to settings for that). There's no reason to let people publish new apps that don't adhere to new permission model, but Google just doesn't care.

They also need to clearly mark use of system resources in the background - just like we have the GPS icon, we need a clear indication of active microphone, speaker and other hardware modules while running in the backgorund.

Re:More Android phones than ever are covertly listening for ... by cwyers on Saturday May 06, 2017 @02:21PM (#14281575)
Nearly 2/3rds of Android phones that have accessed the Google Play store in the week leading up to May 2nd are not on Android 6 or later:

https://developer.android.com/about/dashboards/index.html

Re:More Android phones than ever are covertly listening for ... by izacus on Saturday May 06, 2017 @02:32PM (#14281605)
I'm not sure what you're comment is trying to say - TARGETING a new API doesn't meant you don't SUPPORT an older API. It just determines backwards compatiblity behaviour. We currently release a product that supports Android 4.1 while targeting Android 7.1.

Also this dashboard is hugely misleading for the HN audience - in western audiences (USA, Canada, EU, etc. - countries HN users are from) we're tracking ~10% devices that are running Android 4.x and more than 40% devices running on Android 6.0 with additional 15% on 7.x - meaning more than half of active western users are running decently modern Android.

Re:More Android phones than ever are covertly listening for ... by cwyers on Saturday May 06, 2017 @02:36PM (#14281617)
What it's trying to say is that this can be a big problem even if it doesn't affect Android 6 and up. Your own statistics say it can affect up to 45% of Android users.
Re:More Android phones than ever are covertly listening for ... by izacus on Saturday May 06, 2017 @02:48PM (#14281657)
I completely agree. The Android upgrade situation is a huge and rather well known issue.
Re:More Android phones than ever are covertly listening for ... by pjmlp on Sunday May 07, 2017 @02:01AM (#14284103)
Not to Google, as they don't care.

Now with Android N reaching 7%,one year later, who do they think will even bother with Android O?

Re:More Android phones than ever are covertly listening for ... by on_and_off on Sunday May 07, 2017 @02:34PM (#14286802)
I work on a large Android app and we do bother with Android O.

As soon as the sdk will be final we will think about compiling against it and targeting it.

We are not in a huge hurry, it can skip a release or 2 (we release every 3 weeks). There are no big breaking changes though (unlike let's say Marshmallow) so as long as the support lib is stable (it needs to match with compile version) we are going to support it ASAP.

We also have some N features like shortcuts.

Re:More Android phones than ever are covertly listening for ... by pjmlp on Sunday May 07, 2017 @03:36PM (#14287162)
How many customers do you feel will have devices with Android O, given Android N is around 7% after one year?
Re:More Android phones than ever are covertly listening for ... by on_and_off on Monday May 08, 2017 @05:00AM (#14290166)
It goes further than that.

First, that 7% figure is the whole Android (with play services) user base, numbers are pretty different on the dashboard of our general public app.

Secondly, we will start by compiling for O : the supports libraries are only tested for their corresponding compile version. That way we will be able to use new support lib features on all Android versions.

Then, we will target O (probably in the same release of the app). It should be pretty trivial : this is not marshmallow with the new permission system, system level changes in O are manageable.

For clarification, the build script of an android app separates compile version (= binary compatibility) and target version (= you handle the new behaviors of the system like granular permission in M)

By targeting O ASAP we :

- are potentially able to ship some features based on this release, like shortcuts for N. Sure, we are not going to spend a lot of dev time on an O-only feature right now but there are some easy wins. And of course the install base does not stay small for very long.

-are able to detect potential problems before OEMs start launching flagships with that Android version and we get millions of crashes / day.

There is really no good reason to stay behind.

Re:More Android phones than ever are covertly listening for ... by on_and_off on Saturday May 06, 2017 @05:57PM (#14282480)
The landscape of people who actually download apps is very different though.

And he has a point : Google could easily ask that all new apps target the last version of the OS.

Re:More Android phones than ever are covertly listening for ... by pjmlp on Sunday May 07, 2017 @06:32AM (#14284780)
Just as they could "nicely" require OEMs to get their game straight.
Re:More Android phones than ever are covertly listening for ... by on_and_off on Monday May 08, 2017 @09:36AM (#14291317)
Not sure how it could work out tbh.

Ok I am not a lawyer or a part of the negotiations between Google and OEMs but I don't think Google can force OEMs to keep phones up to date for a given amount of time.

First, it is not just up to the OEMs, they need new drivers for new platform versions.

Secondly, what leverage does Google have here ? Preventing OEMs from releasing phones with Play Services looks like a really sharp double edged sword. Even triple edged actually since consumers would also suffer from this kind of deal.

Re:More Android phones than ever are covertly listening for ... by pjmlp on Sunday May 07, 2017 @01:59AM (#14284099)
Here in Germany all low budget phones are still 4.x, which are what everyone on pre-paid mostly buys.

Same applies to the southern countries, which I visit regularly.

Most people on 6.0+ are on contracts, which are the minority, even though many of them might be using your app.

Re:More Android phones than ever are covertly listening for ... by anigbrowl on Saturday May 06, 2017 @04:34PM (#14282105)
Please don't use all caps on HN. Use an asterisk * at the beginning and end of the text you wish to emphasize to get italics.
Re:More Android phones than ever are covertly listening for ... by anon1385 on Saturday May 06, 2017 @02:40PM (#14281630)
Are you suggesting it's ok for non-western users to be tracked this way? Why would we ignore most of the world when discussing an issue like this?
Re:More Android phones than ever are covertly listening for ... by reciprocity on Saturday May 06, 2017 @03:02PM (#14281720)
I think you may have misread that comment. Op didn't imply anything of the sort.
Re:More Android phones than ever are covertly listening for ... by izacus on Saturday May 06, 2017 @02:46PM (#14281650)
I never said or claimed anything like that. Where did you get that idea?
Re:More Android phones than ever are covertly listening for ... by cwyers on Saturday May 06, 2017 @04:41PM (#14282141)
Then what were you claiming? Because I posted the worldwide stats and you called them misleading. Misleading who about what?
Re:More Android phones than ever are covertly listening for ... by izacus on Saturday May 06, 2017 @05:01PM (#14282240)
About the actual usage and activity of the devices in the wild. The network that does that is targeting western markets where the availability of devices that are vulnerable is dropping steeply - not fast enough, but still.

I've yet to also see a single worldwide USAGE statistic that would reflect that dashboard. Whatever Google is counting is not the users that actually download and use apps (and are thus vulnerable) - pretty much all stats I've ever seen (even on apps with millions of worldwide downloads) have significantly higher update rates. Hence - misleading.

Re:More Android phones than ever are covertly listening for ... by anigbrowl on Saturday May 06, 2017 @04:35PM (#14282115)
anon1385 is a step ahead of you; s/he inferred it from your argument and is asking you to consider the implications thereof.
Re:More Android phones than ever are covertly listening for ... by anon1385 on Saturday May 06, 2017 @03:38PM (#14281864)
Your comments here are arguing that this isn't a problem. You called the stats dashboard "hugely misleading" with the implication that the problem is not as bad as it would suggest, but actually it shows that the problem is worse than the average western based HN developer realises (based on their day to day experience).
Re:More Android phones than ever are covertly listening for ... by gcb0 on Saturday May 06, 2017 @07:16PM (#14282819)
do the opposite.

build your app for android 5 and push to the store.

done. target 100% of devices and get no dialog for android 6 users.

Re:More Android phones than ever are covertly listening for ... by oneshot908 on Saturday May 06, 2017 @03:38PM (#14281868)
I would love love love if my Android phone would occasionally provide me a summary of which apps are making use of the camera, the GPS, and the microphone and allow me to disable them.

Sure, I can hunt for this on my own. That's not the point here. If I'm walking around with a supercomputer in my pocket, I'd like it to do this sort of stuff for me automagically.

Re:More Android phones than ever are covertly listening for ... by izacus on Saturday May 06, 2017 @04:57PM (#14282218)
Settings -> Apps -> Gear icon in the top bar -> App permissions should do what you want (at least it does on 7.1.2 / Pixel).

Not obvious I know :/

Re:More Android phones than ever are covertly listening for ... by yehi on Saturday May 06, 2017 @03:45PM (#14281899)
One thing that Google really should do is allow a feature to temporarily give permissions or fake giving permissions. For example, I want to send my location on Whatsapp then I would want it to ask for permissions every time. Similar to how certain websites cannot access my microphone just because I let them do it once, neither should apps.
Re:More Android phones than ever are covertly listening for ... by anigbrowl on Saturday May 06, 2017 @04:33PM (#14282100)
If I understand you right, you're saying that this doesn't actually work most of the time - but not that people are not trying it.

Myself, I don't care about the fact that Google is 'failing' on this, because even if they fix all the problems you identify, the people exploit such approaches will find some other loophole to exploit or work around. The inevitable result: another arms race that doesn't create value for consumers.

What I care about is the recurring social problem of which this is just the latest instance: marketing/advertising folk deceiving consumers. If your business model relies on deception then you are a Bad Person, and this applies equally to those who dream up such schemes and those who implement them at the technical level.

The legal system does not move at the speed of software development, and so there are strong economic incentives to engage in such unethical behavior and move on before people catch on and organize themselves to litigate the issue or effectively regulate the behavior. It is time, therefore, to punish bad actors by more direct methods of retaliation, which necessarily involves inhibiting their ability to buy their way out of trouble by renting legal mercenaries.

Re:More Android phones than ever are covertly listening for ... by voidz on Saturday May 06, 2017 @04:57PM (#14282217)
tl;dr "don't fix anything because of other bugs." Is that what you're saying? If so: that ship don't sail.
Re:More Android phones than ever are covertly listening for ... by anigbrowl on Saturday May 06, 2017 @06:00PM (#14282493)
That is not what I'm saying. I am articulating a different concern about the nature of the problematic behavior which exploits the vulnerability.
Re:More Android phones than ever are covertly listening for ... by macawfish on Saturday May 06, 2017 @01:50PM (#14281436)
Yes, I agree, including gyroscopes. As well as a way of seeing which apps are using the sensors.