Ilie Pandia
11th April 2014, 15:08
Hello,
A bit of context first.
I have changed my mobile subscription to include more data and storage space on the cloud.
Once the subscription was updated, I've logged into the online customer self-care to setup my cloud access.
As you would expect you have a desktop application (that I had to install) and a mobile application.
Here comes the strange part... For the mobile application it said:
"Click here to install on your device".
I laughed and thought: that surely cannot work! I mean how can they know what device do I have, what OS and what my Google Play/Market password is.
But I clicked, just to see what happens. I got a message that the application will be installed shortly. Hm...
I picked up my Android phone and sure enough it started to download and then install the application without any kind of confirmation from my part on the device itself..
Now I'm worried! I think to myself: "I must have confirmed this somehow...". So I do it all over again, and again, w/o any kind of input from me, the Android device has downloaded and installed that application.
As you can imagine that is a huge problem!!
Yes, I had to login into my self-care account, but what happened here just goes to show that a network operator can push apps into your mobile, and unless you're looking at it non-stop you may miss it! And if the network operator can do this, then anyone with the required skill level and motivation can do it. In theory, any pissed off employee from a network operator can push an app into the clients mobile phone to cause harm or steal data. (Or any agent that can infiltrate the operator's network).
How this works is beyond my knowledge... I've tried to Google it, but with no useful results.
Has anyone had a similar experience where some service (like your network operator) can push an application install into you device without your explicit confirmation on the physical device?
At this point I may be carrying a live spying device into my pocket and be none the wiser.
PS: I later found out that the network operator knows exactly what device you have and what operating system. That's still a privacy problem, but let's say I can accept it. But to install an application into my phone w/o my explicit confirmation on the physical device is still NOT OK.
PS2: Google Play (the Google Apps Market) allows you to install applications from the web into your device. But they require you to login into your Google account and so they have the proper credentials to do this. The network operator however, does not have (to my knowledge) my Google login and password.
A bit of context first.
I have changed my mobile subscription to include more data and storage space on the cloud.
Once the subscription was updated, I've logged into the online customer self-care to setup my cloud access.
As you would expect you have a desktop application (that I had to install) and a mobile application.
Here comes the strange part... For the mobile application it said:
"Click here to install on your device".
I laughed and thought: that surely cannot work! I mean how can they know what device do I have, what OS and what my Google Play/Market password is.
But I clicked, just to see what happens. I got a message that the application will be installed shortly. Hm...
I picked up my Android phone and sure enough it started to download and then install the application without any kind of confirmation from my part on the device itself..
Now I'm worried! I think to myself: "I must have confirmed this somehow...". So I do it all over again, and again, w/o any kind of input from me, the Android device has downloaded and installed that application.
As you can imagine that is a huge problem!!
Yes, I had to login into my self-care account, but what happened here just goes to show that a network operator can push apps into your mobile, and unless you're looking at it non-stop you may miss it! And if the network operator can do this, then anyone with the required skill level and motivation can do it. In theory, any pissed off employee from a network operator can push an app into the clients mobile phone to cause harm or steal data. (Or any agent that can infiltrate the operator's network).
How this works is beyond my knowledge... I've tried to Google it, but with no useful results.
Has anyone had a similar experience where some service (like your network operator) can push an application install into you device without your explicit confirmation on the physical device?
At this point I may be carrying a live spying device into my pocket and be none the wiser.
PS: I later found out that the network operator knows exactly what device you have and what operating system. That's still a privacy problem, but let's say I can accept it. But to install an application into my phone w/o my explicit confirmation on the physical device is still NOT OK.
PS2: Google Play (the Google Apps Market) allows you to install applications from the web into your device. But they require you to login into your Google account and so they have the proper credentials to do this. The network operator however, does not have (to my knowledge) my Google login and password.