1

I found in a published paper talks in a part of it about an algorithm of managing permissions and the description contains this statement:

"If the request from app is accessing for hardware, we set the permission being authorized, because hardware cannot do any harm alone"

So, I want to understand what about the situation if the android app get access just to the hardware and has no access to user's data, Is it true that this app can not do any harm on user's privacy (such as record from Mic/Camera and send it to remote server)?

4
  • 1
    Context matters. Perhaps you should link to the paper that you are quoting. If not, we can only speculate on the scope of that assertion.
    – Sas3
    Jul 6 '17 at 13:07
  • If can control the mic and camera it can record sound and images, this is private data. So yes there is a risk. Jul 6 '17 at 13:23
  • hardware alone without storage or "full internet" would be safe against stored data.
    – dandavis
    Jul 6 '17 at 21:23
  • Also, hardware identifiers could be used to fingerprint the device, so data could be linked to a persistent identifier
    – jrtapsell
    Jan 2 '18 at 16:11
1

All "hardware access" from an app is actually access to an abstraction provided by device drivers and/or HAL. In principle, this seems a safe assertion to make - especially with the first use case below. Beyond that, it's paranoia. :)

User's existing data is not at risk if the hardware access doesn't indirectly provide access to the data. e.g., microphone / speaker access may be considered okay.

What if the hardware can indirectly access the data - e.g., if it can access the networking hardware (wifi for example), can we assume that it is actually accessing a driver which is a high-level abstraction of the device? If so, does the abstraction isolate the app? What if the access is to the baseband radio? Can it make a network request (e.g., international call) and infer user info (e.g., "does the user's plan permit international calls"; or combine two accesses - make a VOLTE request - and obtain prepaid balance info from the LTE stack?)

The other extreme of the paranoia is about - with access to the camera and microphone, can the app deduce user info by making additional requests to biometric identification databases (lame example: can facebook identify the user even if logged in with a different persona?)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.