is not going like this twitter thread, but here it goes about the really rubbish Android App that @TRAI puts out for "Spam" Detection. For context look at this report from Reuters.
Link: in.reuters.com/article/apple-…
All code is obtained via dex2jar. 👇
Link: in.reuters.com/article/apple-…
All code is obtained via dex2jar. 👇
1. Who in this world uses HTTP? Only Trai. 🤦♂️. This is the registration API which needs all kinds of stuff and sends it unencrypted. I know that govt. agencies don't like encryption, but this is too much....
2. Once you register with all your phone numbers, then there is OTP also sent over HTTP (This is a constant pattern now).
3. The App also sends all your contact details so that Trai can effectively figure out who is spamming you. Why is that? Why is spamming related to your contact list? Why is everyone interested in your contact list?
4. And why does TRAI needs device ID again and again and again. All in HTTP? This is height of stupidity...
5. And even that HTTP back end does not work half the time. This is total amateur hour. And all one needs for SPAM detection is (Sender SMS, Sender Origin) and may be a Receiver Number. Everything else is not required for SPAM. No data minimisation principles followed here.
6. And finally the permissions list is as usual everything, when all you need is READ_SMS and INTERNET. No wonder Apple said no, because even READ_SMS is frowned upon in IOS. May be Mr. Sharma, you have to fix these issues first?
#
#
