Uber Under Fire for Android Permissions

Here’s yet another charge against Uber’s handling of privacy: The ride-hailing company’s Android app asks for what seems like an excessive amount of access to user data.

And Uber is far from alone among Android apps that demand access to a long list of information and access from its users.

A blog post by Phoenix-based security researcher Joe Giron being passed around today calls out Uber for all the permissions baked into its Android app.

“Christ man! Why the hell would it want access to my camera, my phone calls, my Wi-Fi neighbors, my accounts, etc?” Giron wrote.

Uber said in a statement sent to Re/code, “Access to permissions including Wi-Fi networks and camera are included so that users can experience full functionality of the Uber app. This is not unique to Uber, and downloading the Uber app is of course optional.”

But why does a ride-hailing company need blanket access to just about everything a phone knows about its owner?

The answer comes from Google. A large part of what’s going on here is that Google requires Android developers to ask for privacy permissions up front, when an app is first downloaded. Users have no way to selectively opt out of any of the permissions. It’s all or nothing. (Go to Uber’s Google Play profile and click on “view details” under Permissions to see the list.)

The way Android handles privacy is a weakness versus other mobile operating systems, like Apple’s iOS, which allows users to decline permission to data on a case-by-case basis. Google has made some recent changes to permissions — such as setting up category groupings so they are easier to read — but it actually yanked back a hidden feature last year that some developers had used to allow users to turn off individual permissions.

The way the current system is designed, it forces Android app makers to ask for a lot more up front. Uber rival Lyft’s list of Android permissions is even more extensive, including additions like the ability to send SMS messages and “read calendar events plus confidential information.”

Uber and Lyft have posted explanations for why they demand permission to various Android features, although they do not explain everything.

For instance, Uber says it requires camera access to enable a feature that allows users to enter payment information by snapping a picture of a credit card. Lyft says it needs the camera to take profile photos.

A better system might allow users to grant one-time access to the camera for the purpose of taking the picture of the credit card or the profile photo, and then block Uber and Lyft from the camera unless it’s explicitly needed in the future.

Reached by phone, Giron said he was planning to do additional research to see if and when Uber actually takes advantage of all the data and functions it has permission to access.

“Uber asks for the permissions up front,” Giron said. “The question then becomes, what are they going to take and use?”

He added, “We have a natural tendency to feel that we’re being watched or spied upon. I’m showing evidence that it’s possible, but I still need to be presented with more proof that it’s happening.”

Long-time mobile developer William Hurley, who is now CEO of the startup Honest Dollar, said he thinks this is an area that’s likely to draw more fire.

Where Apple and Microsoft discourage developers from accessing data, Google has set up a situation where developers are incentivized to ask for more access than they need, and to do it up front, he said.

“For developers, Android offers more flexibility in how and how much data you can collect on a user. This has led a number of developers to gather as much data on a user as possible, and that’s not always a good thing.”

Hurley added, “I suspect there will be some serious repercussions — both at the consumer level and from a regulatory compliance angle. Uber does operate globally, after all, and the laws are very different in the E.U. and other geographies.”

Google declined comment.