6

This statement in the iOS 7 release notes implies that non-China devices do not need user consent:

iOS now requests user consent for apps to use audio input on all iOS 7 devices. For devices sold in China, iOS will also request user consent for apps to use the camera hardware. iOS SDK Release Notes for iOS 7 GM

Is there any protection against an app accessing either camera without the user's knowledge and/or consent?

This is a follow-up question to the comment on device fingerprinting (and other iOS privacy vulnerabilities) here: What unique fingerprinting information can an iOS7 app collect?

Improve this question

1 Answer 1

Reset to default
2

As of iOS 8, apps do need to request access to the cameras. When an app on iOS 8 attempts to access a camera, it shows a system alert and requests the user to accept the access before the app is allowed. Denying the access will prohibit the app from accessing the camera.

For iOS 7 in your question, yes, an app can access either camera without requesting the user's permission (except in China as you found out). All apps have unrestricted access to view the camera feed of either the front-facing or rear-facing camera and take pictures/videos.

However, access to the Camera Roll to save such media does require the user's consent. Most apps on the App Store request access to photos immediately so as to not interrupt the user whilst they take their first picture, however this is simply to gain access to the general location for saving the media, not for accessing the camera itself. Apps are fully able to capture pictures and video from either camera at will without requesting permission providing it saves the media within the app's sandbox.

Improve this answer
5
  • Do I understand correctly then that any (active) 3rd-party app could potentially take still photos or videos surreptitiously, and phone them home to a server on the internet, with no indication whatsoever to the user?
    – pseudon
    Commented Apr 12, 2014 at 20:58
  • @pseudon Exactly, providing the media is kept within the sandbox.
    – grg
    Commented Apr 12, 2014 at 20:58
  • Thanks. Scary, and hopefully this vulnerability is closed by Apple soon.
    – pseudon
    Commented Apr 12, 2014 at 21:00
  • @pseudon Updated answer! iOS 8 beta does show a request alert for camera access
    – grg
    Commented Jun 17, 2014 at 8:42
  • George, thanks, I noticed the "worldwide" reference in the WWDC privacy session slides devstreaming.apple.com/videos/wwdc/2014/715xx4loqo5can9/715/… A welcome change!
    – pseudon
    Commented Jun 18, 2014 at 14:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .