Finding out what data apps really collect

[harlan4096]

Most apps collect some information about the user. Sometimes, they really need such data to operate: For example, a navigation app requires your positioning information to build a convenient route for you. Developers often use information about you to monetize or improve their service — with your prior consent. For example, they may collect anonymous statistics to find bottlenecks in their app and understand along what avenue it needs to be developed.

But some developers may abuse your trust by stealthily collecting information unrelated to their app’s functionality and by selling your data to third parties. Fortunately, you can use a couple of services to bring such apps into the open.

AppCensus

The AppCensus service helps you find out what personal data apps collect and where they send it. It relies on the dynamic analysis method: The app is installed on a real mobile device, granted all the required permissions, and actively used for a certain period of time. All the while, the service keeps an eye on the app to see what data it sends, and to whom, and whether the data is encrypted.

This offers an insight into the app’s real world behavior. If you feel uneasy about the information AppCensus digs up, you can avoid using the app in question and look for an alternative that keeps its nose out of your unrelated business. But the information AppCensus has collected may turn out to be incomplete; each app is tested for a limited time, and some app features may take a while to get activated. As well, AppCensus analyzes only Android apps — and only those that are free and public.

Exodus Privacy

Unlike AppCensus, Exodus Privacy studies apps themselves, not their behavior. The service analyzes the permissions an app requests, and it looks for built-in trackers — third-party modules made to collect information about you and your actions. Developers often equip their apps with trackers provided by advertising networks, which are made to learn as much as possible about you for the purpose of delivering personalized ads. At present, Exodus Privacy recognizes more than 200 types of such trackers.

Speaking of permissions, Exodus Privacy analyzes them from the viewpoint of the danger they pose for you and your data. If an app should request permissions likely to compromise privacy or disturb the device’s protections, the service will mention it to the user. If you believe an app does not need some potentially dangerous permissions, it is best not to grant them. You can give it more rights at a later time, if you choose to.

Apps’ little secrets

Both services are very easy to use. A simple search on the app’s name will yield thorough information about what data it collects and where the data goes. Unlike AppCensus, Exodus allows users not only to pick apps from a list, but also, using the New analysis tab, to add apps from Google Play for analysis.

To provide an example, we looked at a selfie camera app with 5 million downloads from Google Play. Exodus Privacy shows that the app uses four ad trackers and demands not just access to your camera, but also your device location, which is not strictly necessary for it to operate (in theory, device location may be used for a good purpose — to add geotags to EXIFs of the pictures it takes), as well as your phone and call data, which is anything but necessary for this kind of app.
...

Continue Reading