I have a CO2 monitor that you read through an android app. It cost like $250. If you don't give it geolocation permission, it just says "this app needs geolocation permission" and shows you a button to go to your settings to enable it. Any time you disable geolocation, you get that message and button again.
I have yet to find any geolocation functionality in the app.
EDIT: Please see epukaza's comment below. There is a legitimate reason for this permission, which his comment explains.
https://developer.android.com/guide/topics/connectivity/blue...
Assuming you’re right, it’s really sad that multiple sibling posts assume that the app was doing something shady and selling the user’s data. It shows, in general, how little trust people have in apps on their own phones.
Plenty of app developers have muddied the water enough that apps should have a lower level of trust given to them. Stealing data is a reasonable fear now. It is not reasonable to assert otherwise.
It is therefore reasonable for a person to wonder why geolocation is requested but then be suspicious why it doesn't seem to need it. Regardless of the underlying technical reason. Those technical reasons are part of informed consent. If I don't have informed consent, do I really have consent?
Its also not a sad state at all. Its healthy. Its part of the modern landscape that someone can be suspicious and rightly so. If not, you're setting people up for misfortune. Is there some reason you want people to blindly trust like this? That seems almost abusive to me.
This is almost all apps. Your default assumption should be that anything on the big app stores is being as malicious as they can get away with -- especially if it is a forced install leveraging some product you have already purchased that could easily be sent over a standard protocol.
_Maybe_ the app is fine, but in the cases I've checked big corporations abusing your privacy is the norm.
I would be curious if it does any or all of:
- Fetching GPS coordinates, which are typically to many decimal places. - Making API requests to external servers that you don't own.
A tool like MobSF (https://mobsf.github.io) might be very enlightening to understand what a given app does, or at least can do. I've tinkered a bit with an iOS app in it, but not Android so far.
Also, proxying your device through Burp Suite or ZAP could also be interesting to see what traffic occurs, especially if the developers weren't picky about valid TLS certificates.
Sure, but why does the app need to be able to scan for any and all Bluetooth devices? There should be an entry in the manifest describing the kind(s) of devices the app wants to interact with, and only those devices should appear in the scan. Naturally the list would need to be reviewed to verify that the selected devices are related to the app, and presented to the user in the app store along with all other requested permissions.
In this particular case the same company designed both the app and the device it's connecting to, so for all we know the device could have an embedded GPS receiver to provide the app with much more detailed location information than it could get from Bluetooth alone. It could also just relay its own Bluetooth scan results. However, the app at least couldn't easily get location data from Bluetooth scans when the device isn't in range.
Why do they refuse to opt you out of being an unpaid drone generating $0.02 worth of data for them after you paid them $250? Because they can, since we don't have any laws forbidding it.
https://github.com/larsp/co2monitor
Adafruit’s SCD-30 is also nice and pairs well with a Pi Zero W.
As far as I know (please correct if this is wrong), there's no such thing as an app with no Internet permissions. All apps can access the Internet without permission, and only additional uses of the Internet (e.g. seeing your WiFi AP name) require special permission.
AFAIK the "Internet" permission many apps requested was actually for this more advanced usage - just to hit a REST endpoint or something required no permission at all.
https://developer.android.com/reference/android/Manifest.per...
It's so commonly requested though, that virtually every app does have it.
But for quite a while you could still read the permissions list in the play store, and see if it used it. And adding the permission would still give you a warning on upgrade (outside the play store anyway). Both of those (I believe) are gone nowadays.
It's obviously going to be requested by most, but its absence can be extremely relevant, e.g. https://play.google.com/store/apps/details?id=keepass2androi...
It is wrong. Internet permission is made of INTERNET and ACCESS_NETWORK_STATE, which are "normal"-level permissions to be specified in the Manifest. Without them, no Internet. Correctly: there are plentiful applications that do not need it.
In particular because not everything is a runtime permission. E.g. I like to know that [apk X] has no internet or file permissions at all - it rules out nearly all practical ways to leak your information. And google just keeps taking more and more steps to hide that information from me.