The great thing about Android applications is that often they generally decompile quite nice into human readable Java soo the barrier of entry can be quite low to start reversing.

Grab a copy of JADX[1] - it will decompress and decompile the APK files. If you don't have an Android handset, use an emulator and/or grab APKs from apkpure[2]

Dynamic analysis is a bit more challenging. In my blog post I use Frida[3] extensively.

If you get started on something and get stuck/looking for support, feel free to DM me on Twitter (handle in HN profile), more then happy to help.

[1] https://github.com/skylot/jadx

[2] https://m.apkpure.com/

[3] https://frida.re/docs/android/

I kid, I kid.. Somewhat.

> reveals that that the Apple iPhone version is also location data to remote servers.

I’m guessing there should only be 1 “that” and there’s a missing “sending” between “also” and “location data”

https://www.amazon.de/dp/B0BLG9Z462

You can click the images where the third one contains a comparison. Interesting that pretend that BM6 has this as a special feature since it just is a feature of the app.

The QR code [0] on the device points to this app: https://play.google.com/store/apps/details?id=com.dc.bm6

So I checked other URLs like https://link.quicklynks.com/bm3.html and https://link.quicklynks.com/bm4.html, and the latter redirects to https://www.leagend.com/ which operates this YT channel https://www.youtube.com/channel/UCqkvyOFP5cXQ02f3h1Ns42Q

[0] http://link.quicklynks.com/bm6.html

The play store page for this app states:

- No data shared with third parties

- This app may collect these data types

- Data isn’t encrypted

- You can request that data be deleted

I just checked the BM2 app (subject of the blog post series) and they have updated with the same detail [2], updated on the 25th of June 2023.

I'd like to think my blog post put some pressure on them to fix it at risk of their app being pulled. Doesn't excuse them though.

[1] https://play.google.com/store/apps/details?id=com.dc.bm6

[2] https://play.google.com/store/apps/details?id=com.dc.battery...

It's a fine line between data collection for commercial reasons and spying. Of course the mis-representation is an issue all by itself and Apple/Google should kill this app for that reason alone if they are going to be consistent.

No there is not. Your permission is the line

Requesting is easy... but trusting the whole "Yeah, we definitely deleted that data you asked us about" is where things can be tricky. :/

https://developer.android.com/guide/topics/connectivity/blue...

Is Android actually verifying this, or can this be used to misrepresent what’s going on?

Binning these to practical real-world "sacrifices" makes far more sense. I'd say Apple is ahead on UX, not behind.

I get it that BLE MAC addresses can provide very detailed location information, in my case my thermostats/valves broadcast MAC addresses all the time, so if they are sniffable, it is known that I'm at home, but this is not the case when I'm on my bike or in my car, where maybe there's the address of the bike computer or the car radio, because these are traveling along with me, giving no positional information.

Once I meet other people or walk around some streets, geolocated BLE MAC addresses will be present again, but it still isn't the same as high resolution GPS. GPS doesn't require an additional database lookup from a database which the "spy" may not even have access to, it directly sends latitude, longitude and accuracy.

It's annoying that Google neglected or still neglects this.

In theory it would be slightly harder to determine the users location if only BLE scanning was granted but I'm sure the Alibaba would have no difficulty getting more or less the same amount of location info.

Plus how do you express this to users? Do you call it "BLE Scanning" and try to explain that this reveals location information? Most users will miss that explanation. Or do you call both permissions "Location"? But now what is the incentive to request the lesser one.

I actually think that Google made a reasonable call here. If they both grant access to more or less the same info it makes sense to be behind the same permission.

Sorry for complaining, but it's so hard to find standalone devices that don't require an app nowadays (simple example: try finding an LED lamp where you can choose the light color that allows doing it with a button on the lamp itself without app - I found one but it was non-trivial and it still doesn't allow color cycling without app). If people wouldn't prefer this BS, it would be easier to find sane electronics/electrics again.

(Almost) No one is making their car purchasing decisions based on the existence of a car battery health feature.

[0]: https://www.motorbiscuit.com/oil-dipsticks-disappearing-at-a...