4

During today's apps update, ORBOT update asks for aditional permissions: a) photo/media/files, and b) Device ID and caller information.

(Android 5.0.1, current ORBOT (pre-update) 15.2.0-RC-8-multi)

Why would an app, with the main purpose of providing anonymity, actively request permission to access Device ID and caller information?

So far I did not allow it and wonder what is more dangerous, using an outdated version, or granting paradoxical permissions...?

Concrete questions:

  1. Do others experience the same request (otherwise it would be a hint that my device is compromised)?
  2. Does somebody have the chance to analyze file access and network traffic (if encryption allows - might never find out?) and test if and how ORBOT makes use of these permissions : (a) where it sends ID information, (b) what files it wants to read/write that have not been necessary for a long time?
  3. Does somebody have an explanation why ORBOT would legitimately need these permissions? Or is there any information if ORBOT app is compromised, ...? Some other (general, not TOR-specific) causes are listed in Falco's answer here, but I cannot believe ORBOT's programmers (thanks!) would accept them (by mistake / lazy&incompetent coding / needed to get access to legitimate functions...)?

Thanks for helping!

  • 1
    The way google grouped permissions on android is idiotic. They often combine harmless essential permissions with critical permissions. – CodesInChaos Jun 9 '17 at 10:14
  • I am protecting this question as it has demonstrated a tendency to pull in commentary from users worried about the changes that are not answering the question being asked. – AJ Henderson Jul 25 '17 at 20:01
3

Why would an app, with the main purpose of providing anonymity, actively request permission to access Device ID and caller information?

Quoting the Play Store listing: "NEW OPTIONAL PERMISSION: "Write External Storage" and "Read Phone State" need to support Hidden Services backup and background services. No personal data is read, stored or transmitted."

Do others experience the same request (otherwise it would be a hint that my device is compromised)?

They should, since those permissions are in the source tree.

Does somebody have the chance to analyze file access and network traffic (if encryption allows - might never find out?) and test if and how ORBOT makes use of these permissions : (a) where it sends ID information, (b) what files it wants to read/write that have not been necessary for a long time?

If you are concerned as to what Orbot does, review the source code, then build from that source code. You are not required to trust what is delivered via whatever app distribution channel that you are using, nor are you required to make sense of encrypted-by-design network traffic and such.

Does somebody have an explanation why ORBOT would legitimately need these permissions?

See above. My understanding is that they added Tor hidden service support, and for that they needed those permissions.

Since the targetSdkVersion is 25, ideally they should be prompting you for those permissions only if you use functionality in the app that needs them. That's the experience that I get, installing the latest from the Play Store on a Nexus 5X — while the permissions show up in Settings, they have not asked for them, and so do not have them. This is perfectly normal behavior on Android 6.0+.

  • Sorry, I am not an android programmer and can't review/rebuild. ORBOT does request those permissions at update, and at least in Android 5.0.1. (latest I can get for my Samsung) it does not ask only if needed. I perceive android permissions as somewhat useless and counterintuitive, since (a) it is hard to guess what they mean / do not mean ("phone xxx" (even "caller ID") for internet service...), and (b) it is (with stock android) impossible to reject unnededed permissions and still run the app without a certain functionality. +1 for quoting to the respective parts in source and description. – Martin Jun 8 '17 at 23:11
  • @Martin: "ORBOT does request those permissions at update, and at least in Android 5.0.1" -- ah, yes, sorry, I missed that. "it is (with stock android) impossible to reject unnededed permissions and still run the app without a certain functionality" -- it is possible for Android 6.0+, with "stock android". Most of the worrisome permissions, such as the ones that you cite here, will not be granted at the outset and will only be granted when the app displays a dialog asking for them at runtime, and then only if you agree. – CommonsWare Jun 9 '17 at 0:09
  • Thanks for clarification, looking forward to 6.x. Thanks to some kind of intended neglect by /Samsung/ we are waiting... Marshmallow officially released on October 5, 2015 (acc. to Wikipedia), i.e. > 1.5 yr ago. – Martin Jun 9 '17 at 19:39
4

Thanks for asking and caring. We understand users can be alarmed by new permissions request, and should have done a better job of explaining what they are for.

From here: https://twitter.com/guardianproject/status/873045668369055744

"Orbot asks for new permissions that are only used if you enable the Hidden Service features."

More details are coming. This only really effects you if you are on earlier versions of Android, that don't allow you to "deny" permissions when they are requested.

  • 1
    There is a new release of Orbot for Android 5.1 and lower, that has removed the required new permissions requested (along with the access to the advanced new HS hosting features). For Android 6+, these permissions are only requested when they are needed, and can be blocked by the user. Please see the updated release here: github.com/n8fr8/orbot/releases/tag/15.4.2-RC-1-multi – Guardian Project Jun 9 '17 at 12:05
  • Fantastic! Thank you for pointing to this link (not sure if part of the developers?), and in any case thanks to all ORBOT, TOR & related developers for this software and for reacting so quickly! - Bonus point: will it be possible to download it from playstore? Many users are not familiar with non-playstore apps. – Martin Jun 9 '17 at 21:16

protected by AJ Henderson Jul 25 '17 at 19:59

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.