Are the Ride and Food Sharing Apps Privacy-aware in Bangladesh? Investigating Android Permissions Usage

Abstract

An android application (Apps) can only access sensitive user information once it gets the user's consent via the ‘android permission system’. Permissions determine how much Personally Identifiable Information (PII) Apps can access and how harmful Apps can be. However, it is often noticed that android Apps developers often gather irrelevant information, directly conflicting with the Apps sole purpose. Consequently, willingly and unwillingly, users are often allowing permissions and putting their privacy at stake. This study investigates and compares whether the same purpose android Apps asking identical permissions or not. For investigation, this work explores widely used food-sharing and ride-sharing Apps from Bangladesh. Twenty (20) such Apps, including Foodpanda, Pathao, Uber, HungryNaki, Obhai were installed followed by a thorough inspection based on their purposes. In addition, this study also considers context-aware user information prioritization and ranks the considered Apps accordingly. This work finds that Android Apps collect more information than needed, although their purpose was identical. On top of that, popular Apps with more downloads and higher rankings tend to collect large-scale irrelevant permissions.