Collecting too much data ... Android. Photo: Bloomberg
More than 100,000 applications available for download from Google's Play Store may be collecting too much data from users, a research firm says.
About one-quarter of more than 400,000 applications studied are "suspicious" or "questionable" because of what they do in the background, such as location tracking, accessing contact lists or harvesting the contents of email messages, according a report issued yesterday by security firm Bit9. Those functions typically go far beyond the programs' stated purpose, Bit9 said.
Android phones warn users when they download applications about what information the programs will access. Whether most people actually read those warnings is another matter. A Google representative didn't immediately respond to a request for comment.
Some of the most aggressive apps are programs purporting to be affiliated with popular brands, such as Facebook and Zynga, Bit9 chief technology officer Harry Sverdlove wrote in an email interview. While the extra functions don't necessarily make the programs malicious, they do raise questions about the developers' intentions, he said.
"Including a common app or publisher in the title is not a guaranteed sign of suspicious behavior, but it is certainly a technique that malicious authors use to trick users into installing their apps," Sverdlove wrote.
App Privacy
The findings illustrate a reality of the application economy: having a vast amount of third-party applications is both good and bad for consumers. With so many unknown developers writing software for smartphones, users must be vigilant about monitoring what permissions they're granting when they download new programs. Just 8200 or so of the applications that Bit9 studied came from what it described as highly trusted developers.
Mobile-app privacy has also attracted the attention of law enforcement.
In California, the only US state to require privacy policies for mobile applications as well as websites, Attorney General Kamala Harris has warned companies such as United Continental, Delta Air Lines and OpenTable that they are in violation of state law for failing to conspicuously post privacy policies for their mobile applications, Bloomberg reported on October 30.
The companies have 30 days to make the policies readily accessible or face fines of as much as $US2500 for each download of applications that violate the law, which is known as the California Online Privacy Protection Act.
Facebook had better not be reading my personal emails. If they even considered this, they would be sued out of existence tomorrow.
Commenter
peter
Location
Date and time
November 03, 2012, 2:43PM
I question your intelligence if you believe you could sue Facebook out of existence for collecting that information. If you agree to use their service and it says in the terms and conditions that they are allowed to do so I don't see what recourse you could possibly have. That is the price of using their app.
Commenter
Andy
Location
Sydney
Date and time
November 03, 2012, 4:26PM
Andy, if you think facebook can trample all over people's privacy (even if they did put some such disclaimer in any terms and conditions) then it is yourself with the intelligence problem. fwiw I wasn't even talking about the integrated email that facebook recently forced upon all their users (the new article is talking about OTHER apps/mail etc on your android device), but privacy laws would also apply to that, and are not removable or revokable by any company. Suggest you read the article before going off on a tangent in future.
Commenter
peter
Location
Date and time
November 03, 2012, 4:45PM
Why oh why dont they do something about this! eg: have a central repository that has trusted apps from google only. If your file is from outside of the trusted center, then they can put up a nice big warning. It would be ignored, but at least it would be possible to be more secure on your phone. Or make sure that android is built with the stuff we need, so that we dont have to get apps to do those things. Or go into partnership with Symantec or someone to make a commercial repository that is trusted.
Commenter
Simon@syd
Location
Date and time
November 03, 2012, 2:46PM
There are such things as recommended apps by Google. In addition, when you install Android apps, the OS will tell you what it would have access to. At the end of the day, the onus is on the users. No central repository nor warning messages would deter the users from installing Facebook app which collects users' data info. Even Google's apps and Symantec app could collect users' data info.
Commenter
tester
Location
Date and time
November 03, 2012, 3:29PM
It tells you what permissions the app wants to access. If you are silly enough to ignore this than it is your own fault.
6 comments so far
Make a comment
You are logged in as [Logout]
All information entered below may be published.
Thank you
Your comment has been submitted for approval.
Comments are moderated and are generally published if they are on-topic and not abusive.