Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

Is there an app, or will Google produce a system, where I can protect my Android device?

Imagine a soundboard app that's free, but it asks for your contact information. The average user might be naive and just click OK on permissions. About 24 hours later, they start receiving spam email, telemarketing phonecalls to home or mobile phone, or even direct mail to their street address. Now imagine that same app, but criminals wrote it and they now have access to your cameras or microphone. Sure, you opted in on permissions because you didn't know better, but now the criminals can listen in remotely at any time, or even watch you.

I want to permit apps to do certain tasks including camera or microphone usage, or even contact access, but I want to know exactly what's going on for that access. I want to know if it's selling or marketing with my identity information. I want to know if it's going to spy on me remotely.

EDIT: Bruce Schneier and others have commented on this problem recently here:

http://www.schneier.com/blog/archives/2010/08/eavesdropping_s.html

share|improve this question
    
Rules #1 of internet access: Nothing is private and nothing is safe. –  Matthew Read Dec 22 '10 at 23:14
1  
@Read - we can do better than that, can't we? I mean, do you post your street address in your StackExchange profile? You probably don't. Or how about your phone number? Probably not. That's the sort of thing I'm talking about. We need to have levels of control, and to know far more clearly with these apps what we are giving up. –  Volomike Dec 23 '10 at 3:24
2  
Imagine even a camera app that does what it says it does as far as photos, such as make retro photos with a filter. But then someone makes a version almost like it, but forks it into something malicious, which then posts those photos on a website, exposing nudity and so on. See how this can get serious? –  Volomike Dec 23 '10 at 3:25
add comment

3 Answers 3

up vote 7 down vote accepted

Google does do occasional audits. There were apparently some wallpaper apps recently that were doing nefarious stuff and were pulled from the Market and any phones they'd been installed on.

It's imperative that users pay attention to the permissions that are being requested (Why would a wallpaper need to know "Phone state" or my Contacts?) and simply not install anything that looks wonky. Pay attention to the ratings and the comments and, if something looks too good to be true, it probably is.

Everybody wants everything for free. The price of that is that your marketing demographics are being sold to anyone willing to pay for them. I don't begrudge developers the ability to make a profit.

share|improve this answer
    
Wallpaper apps that analyze my contacts. That's scary. Imagine an app activating one's camera or microphone without one knowing it -- even scarier. –  Volomike Dec 23 '10 at 3:22
add comment

The Security Audits in the market only bring advantage when you just pull your apps from the market. Also be careful with Apps from untrusted sources, for example the app could exploit a security bug in the OS and so get root rights. Then it would get all rights without asking you for permission. Probably such an app in the market would be found after a short time. But if you download an apk on the internet from an untrusted source you should be careful and think about if you really need it and can trust the source.

Another great project is Taintdroid Probably what you 're watching for. But at the moment i think you can only use it when you have a Nexus Devloper Phone.

share|improve this answer
    
Thanks for pointing out Taintdroid. Sounds like what we need is a Taintdroid device that sits out there, finding issues, and exposing them on the web for a blacklist that people could vote up or down or add comments about. –  Volomike Dec 23 '10 at 3:20
    
not a bad idea. But i think the larger problem at the moment for android is the fragmentation of different os versions around on the devices and the problems resulting. Mainly that you can't fix your os bugs because your manufacturer doesn't supply an update or if he does just months later. –  NES Dec 23 '10 at 11:00
add comment

I think one of the better ways to "know more" about an app would be to check out its reviews online - there are loads of Android Blogs, plus reviews written by users in the market comments. You can also check them out on sites like http://appbrain.com

share|improve this answer
    
It's easy for developers to create fake reviews, and cause negative reviews to scroll off. As well, if no one knows about a security issue because it's not been discovered yet, they won't mention it in a review. And last, you only get so many chars in a review and that limits what can be said. –  Volomike Dec 23 '10 at 3:19
    
You can't rely on reviews to tell you about flaws that a small minority of reviewers will be aware of. This XKCD cartoon puts the point pretty well... in reality, that 1 star review would be invisible under hundreds of other reviews xkcd.com/937 –  user568458 Jun 2 '12 at 14:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.