Google Play 'flaw' risks users' safety

Your favorite entertainment is now all in one place, always accessible on the web and across your android devices.

Millions of Google customers have had their personal details exposed after massive security hole was discovered in the Google Play store Source: Supplied

EVERY time you purchase an app on Google Play, your name, address and email is passed on to the developer, it has been revealed.

The "flaw" - which appears to be by design - was discovered by Sydney app developer, Dan Nolan who told news.com.au that he was uncomfortable being the custodian of this information and that there was no reason for any developer to have this information at their finger tips.

You may remember Mr Nolan as the creator of the Paul Keating insult generator all that hit number one in the Aussie App Store last month."

"Let me make this crystal clear, every App purchase you make on Google Play gives the developer your name, suburb and email address with no indication that this information is actually being transferred," Nolan wrote on his blog.

"With the information I have available to me through the checkout portal I could track down and harass users who left negative reviews or refunded the app purchase."

Harrassment aside, the problems posed by malware - "virus" programs that infect your phone, or computer and steal your personal details - are far more serious.

With Google customers' details just sitting in developers accounts, all it would take is a half decent piece of malware software for that information to be accessed. These personal details could then be used to access the users' bank details. That's also more than enough information to be able to access your other devices which could also be mined for more data - insurance information, other credit cards -  which could then be used to access your banking credentials.

Mr Nolan told News.com.au that tens of millions of Google customers could be affected.

"As far as I can tell this impacts every person who purchased an App on the Play Store," he said.

"I can't see any way to opt out of providing that information and it seems to be a feature of the Google checkout process. I don't know whether it applies to free apps, but there are hundreds of thousands of apps that are available for pay on the play store and there are millions of people who buy Android apps out there, I'd say easily millions or tens of millions of people.

"It's active in every market that Google accepts payment for apps. That's a lot of people having their personal information handed over without them knowing."

Mr Nolan told News.com.au that user information has always been provided to developers, "as far as he could tell and that the reason it hadn't been discovered until now was because the people who would have paid attention to it were likely exploiting it and selling users' personal information, it using it as an extra source of revenue on top of what they were making off their Google Play / Android app.

"In comparison to the information you get from Apple which is just a quantity of sales in a Country and then a cheque three months later, this is absolutely absurd," he said.

"I doubt anyone expects to have their contact information, name and suburb sent to a developer purely because they decide to buy an app off the Play Store. "

Google's terms of service state that it may store your personal information including your name, address and billing details, but nowhere in its privacy statement does the company explicitly state that it passes on your personal information to developers, every time you purchase their app.

The terms of service state that Google will share your address and personal information if you purchase a magazine subscription through Google Play, but it makes no mention of other apps.

"This is a massive oversight by Google," Nolan wrote on his blog.

"Under no circumstances should I be able to get the information of the people who are buying my apps unless they opt into it and it's made crystal clear to them that I'm getting this information. This is a massive, massive privacy issue Google. Fix it. Immediately."

Google has not responded to news.com.au's request for comment.

UPDATE 1.40pm: After doing some more research, Mr Nolan told News.com.au that sometime before October last year, Google used to provide developers with "alias" email addresses of people that had purchased apps in Google Play, rather than their real address.

"Sometime around the end of October or November they stopped generating that email and just passed on the real details of the users," Mr Nolan told News.com.au.

Mr Nolan said that this could be "side-effect" of Google's continued integration of Google+ into all their properties.

"If not, a deliberate decision was made to provide that information to the developers through the Google Checkout Portal, without conveying that the policy had been changed to users."

If this is correct, then it means that Google has only recently begun sharing user information with developers, a small mercy.

However, "every purchase made on Google Play actually does this now," Mr Nolan said. 

"This is new behaviour since October/November but it was at some point either an oversight or a deliberate change."

The problem could be that Google Checkout (a process that was designed for the purchasing of goods online, similar to checkouts seen on eBay or Amazon) was added to the Google Play store without being customised for apps.

There's reason a retailer would need a customer's address, in order to ship their goods to them safely. The same cannot be said for app developers.

News.com.au is endeavouring to get in contact with Google over this. But so far it has refused to comment on the record.

Meanwhile, a developer who wished to remain anonymous told News.com.au that anyone who sells an app on Google Play are required to complete their own tax returns (as opposed to Apple who does it all on behalf of the developers).

They therefore need customers' addresses in order to complete a tax return. 

It's still unclear, however, if this has always been the case. 

If you're selling an app in the Google Play store, News.com.au wants to hear from you. news@news.com.au

EARLIER: This story was amended at the request of Google.

Anda sedang membaca artikel tentang

Google Play 'flaw' risks users' safety

Dengan url

http://duniasikasik.blogspot.com/2013/02/google-play-flaw-risks-users-safety.html

Anda boleh menyebar luaskannya atau mengcopy paste-nya

Google Play 'flaw' risks users' safety

namun jangan lupa untuk meletakkan link

Google Play 'flaw' risks users' safety

sebagai sumbernya