Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

I purchased a very popular IM app from the Marketplace, as it was the only one that was able to connect to my company's Jabber server, and I've been using it successfully for months now. On November 30th or December 1st it stopped working, I assumed due to an issue on my company's server, since they're always tinkering with it. Late last week I started looking into it and I found out, much to my utter horror, that it wasn't my company's server that was at fault, it was the IM app's server -- I have been logging in to my company's server through their server for months now, meaning that their server had access to my password (which can be used for just about every system I use at work). I verified this by rooting my phone, installing WireShark and looking at the network traffic.

I've asked for my money back, since I paid for the app, but I really want to get the app removed from the marketplace, as it's a huge danger to anyone using it.

Please note that I have no proof that this company was harvesting anyone's password, but they could be doing it. Regardless, they're transmitting my login credentials in the clear (though they are encoding the password, which I'm sure will deter all but the most hardened hackers -- not!).

share|improve this question
    
A lot of the IM apps that allow you to connect to more than one IM service at a time work this way. If anything a lot of users are going to see this as a benefit as it means you can connected to Jabber, MSN, GTalk, AOLIM, etc all with only one network connection using up your battery and data limits. –  GAThrawn Dec 13 '10 at 10:27
    
@GAThrawn - that's an interesting point; I hadn't looked at it that way. OK, so maybe nothing malicious is happening, but it's still dangerous. Not sure what to do, now. –  Joe Casadonte Dec 13 '10 at 15:22
    
and you're right that it's the sort of thing that any app should definitely warn you that it's doing. I'd be concerned too about apps sending my logins to their own third-party servers without any warning. Obviously as we don't which app you've had this with we don't know whether they do warn or not. –  GAThrawn Dec 13 '10 at 15:54
add comment

2 Answers

up vote 11 down vote accepted

When you uninstall an app from the Market, it asks you for a reason. If you choose "It's malicious", it will prompt you for a report. And you can leave a comment on the app (before uninstalling) to warn other users.

Since you have no proof they did or intended to do anything wrong with your info, there's nothing else you can do. You won't get the app removed from the Marketplace.

share|improve this answer
    
Not all apps ask for a reason when you're uninstalling them. I believe this is something that a developer needs to include of his own volition. –  Sparx Dec 13 '10 at 16:32
4  
App developers don't ask for that information. (Actually, as a developer, I wish that I was able to see that information.) I think it only happens when you uninstall via the Market app instead of another App manager. –  shmuelp Dec 13 '10 at 17:29
    
@shmuelp Exactly. –  Matthew Read Dec 13 '10 at 18:42
    
The Market app no longer thinks that the IM app is installed for some reason, so I don't have the option to uninstall it. (sigh) –  Joe Casadonte Dec 14 '10 at 15:44
    
Install it from the Market and then immediately uninstall ;) –  Matthew Read Dec 14 '10 at 17:47
add comment

You can do what Matthew Read mentioned but if you visit the app details page in the Android Market and scroll all the way to the bottom there is a Flag as inappropriate link that will allow you to report the app.

share|improve this answer
    
Ah, I missed that! That does seem to be more oriented towards reporting obscene or malicious content, however. –  Matthew Read Dec 13 '10 at 18:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.