The excess permissions in Android Apps – Adobe Reader, Dragon, Evernote, Groupon, Hipmunk, LinkedIn

Via Sebastian Porst circa 2012-04-27.

Each one deserves treatment on its own

  • Adobe Reader: Full Internet Access (+Adobe)
  • AppAware: Retrieve running applications (+AppAware)
  • Dragon, Fly! Free: Modify/delete USB storage contents
  • Evernote: Read calendar events, plus confidential information (+Evernote)
  • Groupon: Automatically start at boot + Modify/delete USB storage contents (+Groupon)
  • Hipmunk: Read calendar events, plus confidential information (+Hipmunk)
  • LinkedIn: Read contacts, calendar events, plus confidential information (+LinkedIn)
  • Uber: Read contacts, Take pictures and videos without confirmation,
  • Xing: Read contacts, Your Accounts, Take pictures and videos without confirmation, Control Near Field Communication

These apps don’t work on your behalf.  As such, all of these earn the coveted Poisonous App.  Avoid.

  • There’s some argument that perhaps a travel scheduling app needs to see your calendar.  Maybe.
  • But why a social networking app needs to see your calendar+confidential is unclear.

Jeannie (like Siri) is fantastically dangerous

Jeannie (Like Siri)

This means that any elements on any calendar that is visible to you (shared with you) is totally public.  It can be, and you consent to have this indexed and displayed to the world irrevocably.  For this, the app receives the coveted Poisonous App appelation.  Avoid.

Who are these people and why would they even want to hold that sort of data?  Temporarily?  Ever?

From the permissions page on Play Store.

Your personal information

read your contacts
Allows the app to read data about your contacts stored on your tablet, including the frequency with which you’ve called, emailed, or communicated in other ways with specific individuals. This permission allows apps to save your contact data, and malicious apps may share contact data without your knowledge. Allows the app to read data about your contacts stored on your phone, including the frequency with which you’ve called, emailed, or communicated in other ways with specific individuals. This permission allows apps to save your contact data, and malicious apps may share contact data without your knowledge.
read calendar events plus confidential information
Allows the app to read all calendar events stored on your tablet, including those of friends or co-workers. This may allow the app to share or save your calendar data, regardless of confidentiality or sensitivity. Allows the app to read all calendar events stored on your phone, including those of friends or co-workers. This may allow the app to share or save your calendar data, regardless of confidentiality or sensitivity.
add or modify calendar events and send email to guests without owners’ knowledge
Allows the app to add, remove, change events that you can modify on your tablet, including those of friends or co-workers. This may allow the app to send messages that appear to come from calendar owners, or modify events without the owners’ knowledge. Allows the app to add, remove, change events that you can modify on your phone, including those of friends or co-workers. This may allow the app to send messages that appear to come from calendar owners, or modify events without the owners’ knowledge.

Actuality

Open Vehicle Systems | Open Vehicle Monitoring Systems (OVMS)

Site & Project

Product & Output

Permissions

  • Precise Location
  • Full Network Access

Mentions

  • Feels like “OnStar RemoteLink for Tesla”
  • Tesla focused (exclusively)

Confusion

Among the Site Name, DNS name, Product Name, App Name

  • Open Vehicles
  • Open Vehicle Systems
  • Open Vehicle Monitoring Systems

arXiv mobile (Android App)

arXiv mobile - Support Edition
There are two apps, the $0.00 and the $1.99.  The pay one is a donation.  There is source code available under a GPLv2 license.

arXiv mobile $0.00 arXiv mobile $1.99

 

Project

  • arxiv-mobile at Google Code
  • source code
    svn checkout http://arxiv-mobile.googlecode.com/svn/trunk/ arxiv-mobile-read-only

Summarization

All files 165
Java files 16
Java lines of code 4469
ArxivAppWidgetProvider.java 198
arXivDB.java 208
arXiv.java 1039
EditPreferences.java 13
Feed.java 32
History.java 29
HistoryWindow.java 190
PrintDialogActivity.java 147
RSSListWindow.java 424
SearchListWindow.java 624
SearchWindow.java 297
SingleItemWindow.java 611
SubarXiv.java 264
XMLHandlerCreator.java 86
XMLHandlerRSS.java 140
XMLHandlerSearch.java 167

Files

$ find arxiv-mobile -name .svn -prune -o -print | sort
arxiv-mobile
arxiv-mobile/AndroidManifest.xml
arxiv-mobile/ant.properties
arxiv-mobile/assets
arxiv-mobile/assets/fonts
arxiv-mobile/assets/fonts/FreeSans.ttf
arxiv-mobile/assets/fonts/LiberationSans.ttf
arxiv-mobile/build.xml
arxiv-mobile/local.properties
arxiv-mobile/proguard.cfg
arxiv-mobile/project.properties
arxiv-mobile/publishing
arxiv-mobile/publishing/2010-11-18-10:01:27.svg
arxiv-mobile/publishing/2011-02-02-16:14:22.svg
arxiv-mobile/publishing/2011-02-02-16:16:49.svg
arxiv-mobile/publishing/2011-02-02-16:18:48.svg
arxiv-mobile/publishing/2011-02-02-16:20:43.svg
arxiv-mobile/publishing/2011-02-02-16:25:39.svg
arxiv-mobile/publishing/2011-02-02-16:26:44.svg
arxiv-mobile/publishing/2011-02-02-16:28:24.svg
arxiv-mobile/publishing/2011-02-02-16:30:22.svg
arxiv-mobile/publishing/2011-02-02-17:15:18.svg
arxiv-mobile/publishing/2011-02-02-17:15:45.svg
arxiv-mobile/publishing/arxiv-114.png
arxiv-mobile/publishing/arxiv-300.png
arxiv-mobile/publishing/arxiv.png
arxiv-mobile/publishing/arxiv.xcf
arxiv-mobile/publishing/banner.png
arxiv-mobile/publishing/banner.xcf
arxiv-mobile/publishing/cat.svg
arxiv-mobile/publishing/fav.svg
arxiv-mobile/publishing/nook-arxiv-1.png
arxiv-mobile/publishing/nook-arxiv-2.png
arxiv-mobile/publishing/nook-arxiv-3.png
arxiv-mobile/publishing/nook-arxiv-4.png
arxiv-mobile/publishing/nook-arxiv-5.png
arxiv-mobile/publishing/nook-arxiv-6.png
arxiv-mobile/publishing/promo.png
arxiv-mobile/publishing/Renormalized-vertex.png
arxiv-mobile/publishing/screenshot1.png
arxiv-mobile/publishing/screenshot2.png
arxiv-mobile/publishing/screenshot3.png
arxiv-mobile/publishing/screenshot4.png
arxiv-mobile/publishing/screenshot5.png
arxiv-mobile/publishing/screenshot6.png
arxiv-mobile/publishing/search.svg
arxiv-mobile/publishing/ts.png
arxiv-mobile/res
arxiv-mobile/res/color
arxiv-mobile/res/color/tabcolor.xml
arxiv-mobile/res/drawable
arxiv-mobile/res/drawable-hdpi
arxiv-mobile/res/drawable-hdpi/appwidget_bg.9.png
arxiv-mobile/res/drawable-hdpi/cat.png
arxiv-mobile/res/drawable-hdpi/fav.png
arxiv-mobile/res/drawable-hdpi/icon.png
arxiv-mobile/res/drawable-hdpi/list_focused_holo.9.png
arxiv-mobile/res/drawable-hdpi/list_pressed_holo_dark.9.png
arxiv-mobile/res/drawable-hdpi/list_selector_disabled_holo_dark.9.png
arxiv-mobile/res/drawable-hdpi/next_off.png
arxiv-mobile/res/drawable-hdpi/next_on.png
arxiv-mobile/res/drawable-hdpi/prev_off.png
arxiv-mobile/res/drawable-hdpi/prev_on.png
arxiv-mobile/res/drawable-hdpi/tab_focus.9.png
arxiv-mobile/res/drawable-hdpi/tab_focus_bar_left.9.png
arxiv-mobile/res/drawable-hdpi/tab_focus_bar_right.9.png
arxiv-mobile/res/drawable-hdpi/tab_press.9.png
arxiv-mobile/res/drawable-hdpi/tab_press_bar_left.9.png
arxiv-mobile/res/drawable-hdpi/tab_press_bar_right.9.png
arxiv-mobile/res/drawable-hdpi/tab_selected.9.png
arxiv-mobile/res/drawable-hdpi/tab_selected_bar_left_v4.9.png
arxiv-mobile/res/drawable-hdpi/tab_selected_bar_right_v4.9.png
arxiv-mobile/res/drawable-hdpi/tab_selected_v4.9.png
arxiv-mobile/res/drawable-hdpi/tab_unselected_v4.9.png
arxiv-mobile/res/drawable-hdpi/whitesearch_off.png
arxiv-mobile/res/drawable-hdpi/whitesearch_on.png
arxiv-mobile/res/drawable/holo_selector.xml
arxiv-mobile/res/drawable-large-mdpi
arxiv-mobile/res/drawable-large-mdpi/next_off.png
arxiv-mobile/res/drawable-large-mdpi/next_on.png
arxiv-mobile/res/drawable-large-mdpi/prev_off.png
arxiv-mobile/res/drawable-large-mdpi/prev_on.png
arxiv-mobile/res/drawable-ldpi
arxiv-mobile/res/drawable-ldpi/back1.png
arxiv-mobile/res/drawable-ldpi/back2.png
arxiv-mobile/res/drawable-ldpi/back3.png
arxiv-mobile/res/drawable-ldpi/back4.png
arxiv-mobile/res/drawable-ldpi/icon.png
arxiv-mobile/res/drawable-ldpi/tab_focus.9.png
arxiv-mobile/res/drawable-ldpi/tab_focus_bar_left.9.png
arxiv-mobile/res/drawable-ldpi/tab_focus_bar_right.9.png
arxiv-mobile/res/drawable-ldpi/tab.png
arxiv-mobile/res/drawable-ldpi/tab_press.9.png
arxiv-mobile/res/drawable-ldpi/tab_press_bar_left.9.png
arxiv-mobile/res/drawable-ldpi/tab_press_bar_right.9.png
arxiv-mobile/res/drawable-ldpi/tab_selected_bar_left_v4.9.png
arxiv-mobile/res/drawable-ldpi/tab_selected_bar_right_v4.9.png
arxiv-mobile/res/drawable-ldpi/tab_selected_v4.9.png
arxiv-mobile/res/drawable-ldpi/tab_unselected_v4.9.png
arxiv-mobile/res/drawable-mdpi
arxiv-mobile/res/drawable-mdpi/icon.png
arxiv-mobile/res/drawable-mdpi/tab_focus.9.png
arxiv-mobile/res/drawable-mdpi/tab_focus_bar_left.9.png
arxiv-mobile/res/drawable-mdpi/tab_focus_bar_right.9.png
arxiv-mobile/res/drawable-mdpi/tab_press.9.png
arxiv-mobile/res/drawable-mdpi/tab_press_bar_left.9.png
arxiv-mobile/res/drawable-mdpi/tab_press_bar_right.9.png
arxiv-mobile/res/drawable-mdpi/tab_selected_bar_left_v4.9.png
arxiv-mobile/res/drawable-mdpi/tab_selected_bar_right_v4.9.png
arxiv-mobile/res/drawable-mdpi/tab_selected_v4.9.png
arxiv-mobile/res/drawable-mdpi/tab_unselected_v4.9.png
arxiv-mobile/res/drawable/my_tab_indicator.xml
arxiv-mobile/res/drawable/next.xml
arxiv-mobile/res/drawable/prev.xml
arxiv-mobile/res/drawable/tab_bottom_left_v4.xml
arxiv-mobile/res/drawable/tab_bottom_right_v4.xml
arxiv-mobile/res/drawable/whitesearch.xml
arxiv-mobile/res/drawable-xhdpi
arxiv-mobile/res/drawable-xhdpi/cat.png
arxiv-mobile/res/drawable-xhdpi/fav.png
arxiv-mobile/res/drawable-xhdpi/icon.png
arxiv-mobile/res/layout
arxiv-mobile/res/layout/arxiv_appwidget_item.xml
arxiv-mobile/res/layout/arxiv_appwidget.xml
arxiv-mobile/res/layout/author.xml
arxiv-mobile/res/layout/favoritesrow.xml
arxiv-mobile/res/layout/history.xml
arxiv-mobile/res/layout/item10.xml
arxiv-mobile/res/layout/item12.xml
arxiv-mobile/res/layout/item16.xml
arxiv-mobile/res/layout/item18.xml
arxiv-mobile/res/layout/item20.xml
arxiv-mobile/res/layout/item22.xml
arxiv-mobile/res/layout/item24.xml
arxiv-mobile/res/layout/item.xml
arxiv-mobile/res/layout/list.xml
arxiv-mobile/res/layout/mainnew.xml
arxiv-mobile/res/layout/mainold.xml
arxiv-mobile/res/layout/main.xml
arxiv-mobile/res/layout/my_tab_indicator.xml
arxiv-mobile/res/layout/print_dialog.xml
arxiv-mobile/res/layout/searchlist.xml
arxiv-mobile/res/layout/searchrow.xml
arxiv-mobile/res/layout/search.xml
arxiv-mobile/res/layout/singleitem_old.xml
arxiv-mobile/res/layout/singleitem.xml
arxiv-mobile/res/layout/submain.xml
arxiv-mobile/res/values
arxiv-mobile/res/values/arrays.xml
arxiv-mobile/res/values/colors.xml
arxiv-mobile/res/values/strings.xml
arxiv-mobile/res/values/styles.xml
arxiv-mobile/res/values-v11
arxiv-mobile/res/values-v11/styles.xml
arxiv-mobile/res/values-v7
arxiv-mobile/res/values-v7/arrays.xml
arxiv-mobile/res/values-v7/colors.xml
arxiv-mobile/res/values-v7/strings.xml
arxiv-mobile/res/values-v7/styles.xml
arxiv-mobile/res/values-v8
arxiv-mobile/res/values-v8/arrays.xml
arxiv-mobile/res/values-v8/colors.xml
arxiv-mobile/res/values-v8/strings.xml
arxiv-mobile/res/values-v8/styles.xml
arxiv-mobile/res/xml
arxiv-mobile/res/xml/arxiv_appwidget_info.xml
arxiv-mobile/res/xml/preferences.xml
arxiv-mobile/src
arxiv-mobile/src/com
arxiv-mobile/src/com/commonsware
arxiv-mobile/src/com/commonsware/android
arxiv-mobile/src/com/commonsware/android/arXiv
arxiv-mobile/src/com/commonsware/android/arXiv/ArxivAppWidgetProvider.java
arxiv-mobile/src/com/commonsware/android/arXiv/arXivDB.java
arxiv-mobile/src/com/commonsware/android/arXiv/arXiv.java
arxiv-mobile/src/com/commonsware/android/arXiv/EditPreferences.java
arxiv-mobile/src/com/commonsware/android/arXiv/Feed.java
arxiv-mobile/src/com/commonsware/android/arXiv/History.java
arxiv-mobile/src/com/commonsware/android/arXiv/HistoryWindow.java
arxiv-mobile/src/com/commonsware/android/arXiv/PrintDialogActivity.java
arxiv-mobile/src/com/commonsware/android/arXiv/RSSListWindow.java
arxiv-mobile/src/com/commonsware/android/arXiv/SearchListWindow.java
arxiv-mobile/src/com/commonsware/android/arXiv/SearchWindow.java
arxiv-mobile/src/com/commonsware/android/arXiv/SingleItemWindow.java
arxiv-mobile/src/com/commonsware/android/arXiv/SubarXiv.java
arxiv-mobile/src/com/commonsware/android/arXiv/XMLHandlerCreator.java
arxiv-mobile/src/com/commonsware/android/arXiv/XMLHandlerRSS.java
arxiv-mobile/src/com/commonsware/android/arXiv/XMLHandlerSearch.java