Beware of Android Market - especially with your kids

[billythewiz]

I originally posted my "google hater" rant in the General Discussion forums and put (what I hoped was) an Android specific set of instructions in here to raise awareness and help anyone with a similar problem to me.

I presume you are all in this post, carrying on the credit card discussion (which is nothing to do with Android), because an admin closed the General Discussion post. OK, so let's do that here too.

Sorry, but you don't have a leg to stand on here. You are at fault.

Legally I'm sure you are right. Google is one of the richest companies on earth and has more lawyers than either you or I could imagine. I'm sure their legal case is water tight. But morally they are in the wrong on several counts.
1) They have a duty of care with my credit card details. They have allowed my detail to be used without my explicit permission. As for T&Cs, when I went into Google Checkout (to remove my card details) I was told that Checkout was now a part of Wallet and I was FORCED to accept their new T&Cs before I was able to remove my card details. I wonder what the FSA and UK law would have to say about that.
2) Their practice of providing highly colourful, candy coated "free" games aimed at young children, that have "pay content", is highly dubious. It makes me think of a paedophile handing out sweets at a play ground, or a drugs dealer giving out free samples at a school gate. It certainly no different from other "pay for entertainment" sites, i.e. poker sites, etc.
3) They have acknowledged that the lack of any password/PIN protection is a bad thing (they fixed that in September) and yet they continue to ship an ancient version of Market (with Android 3.2), that doesn't support the feature.

[Pancake]

I originally posted my "google hater" rant in the General Discussion forums and put (what I hoped was) an Android specific set of instructions in here to raise awareness and help anyone with a similar problem to me.

I presume you are all in this post, carrying on the credit card discussion (which is nothing to do with Android), because an admin closed the General Discussion post. OK, so let's do that here too.


Legally I'm sure you are right. Google is one of the richest companies on earth and has more lawyers than either you or I could imagine. I'm sure their legal case is water tight. But morally they are in the wrong on several counts.
1) They have a duty of care with my credit card details. They have allowed my detail to be used without my explicit permission. As for T&Cs, when I went into Google Checkout (to remove my card details) I was told that Checkout was now a part of Wallet and I was FORCED to accept their new T&Cs before I was able to remove my card details. I wonder what the FSA and UK law would have to say about that.
2) Their practice of providing highly colourful, candy coated "free" games aimed at young children, that have "pay content", is highly dubious. It makes me think of a paedophile handing out sweets at a play ground, or a drugs dealer giving out free samples at a school gate. It certainly no different from other "pay for entertainment" sites, i.e. poker sites, etc.
3) They have acknowledged that the lack of any password/PIN protection is a bad thing (they fixed that in September) and yet they continue to ship an ancient version of Market (with Android 3.2), that doesn't support the feature.

You need to blame Motorola then, Google only make the OS. They make updates ASAP but its the vendors that take ages.

[billythewiz]

I'm not a preacher by any means, I'm not sure I'd be letting a 5 year old play on such an open device unsupervised.

Sounds like preaching to me

Every parent has this dilemma. How much trust/freedom do you give and at what age. From what you've said ("unsupervised") I presume you are not a parent. I have 4 kids. The oldest (aged 8) is disabled. This means that that when it comes to things like supervision, the only way I can guarantee 100% supervision is never allow them to use the device. My main concern is that the device will get broken (I give it 50/50 that it will survive intact to next xmas), but that is a risk I have to take if I want my kids to be comfortable and confident with technology.

I will be more concerned about what they are doing "unsupervised" when they are older (than 5).

[billythewiz]

Oohhhh, they can buy apps on your google account! what gain would they even get from that? you would own the apps.

What would they gain ? As an act of spite/revenge/vandalism they could easily rack up £1000s of purchases. These could all be "in-app" purchases and so, according to the T&Cs that you accepted, are all non-refundable ! What would you do with 100 "barrels of smurfberries" ?

If your phone gets stolen, and your stupid enough to not have a pin/password/pattern on the phone

That's the problem, the software on the device doesn't provide a pin/password/pattern. It's not that it wasn't set, it wasn't available !

just change your gmail account password, or call your bank?

That's the first thing I did. It was already too late. Credit Cards provide guaranteed payment (I was told).

perhaps Android is a little to complicated for some users

Perhaps you are right. If any of you are considering an Android device for yourself, a child, a parent or spouse, it may be worth considering that to obtain all security features you (or they) may have manually download and install APKs (see instructions in initial post).

I obviously take some of the blame. I use an iPhone and that has the annoying feature of requiring a password (much longer than a 4 digit PIN), even for "free" downloads. I was taken in by Google's "Do No Evil" slogan and so assumed they would use a similar (perhaps even better) system.

BTW, please don't start an IOS vs Android flame war. The iPhone is provided with my job so I have no choice with it. When it came to a tablet, it was easy to choose the Xoom over an iPad.

[Flibb]

I posted a while aback about my surprise that tablets still appear to be seen as large phones and purely personal devices, whereas many people use them as shared devices. 7" tablets are inherently portable, but once they start hitting 10" (for me) they tend more towards home entertainment units. I now use a 3rd party app to lock down the market, and have a pin-code on buying stuff. But I would agree with the OP that automatically linking a credit car used in google checkout, to an android device is questionable. I believe that originally the two systems were seperate, when they merged I assume they linked cards used in google checkout to android.

[Pancake]

on the device doesn't provide a pin/password/pattern. It's not that it wasn't set, it wasn't available !

Hahah yes it does, EVERY version of android supports this under "Location and Security"

[[GSV]Trig]

Go into settings, about tablet then update.

[scaryjim]

... I would agree with the OP that automatically linking a credit car used in google checkout, to an android device is questionable. ...

It doesn't link a card to the device; you link your google account ot a device, and access to all google's services use the regsitered account. So when you request a transaction be made through your google account google will pay that transaction from your google checkout. The card is irrelevant to the process - everything goes through google checkout: it just happens to be pre-authenticated on the android device. Whether that's questionable or not is a different matter - it's a balance of security vs convenience...

Hahah yes it does, EVERY version of android supports this under "Location and Security"

Missing the point - the OP isn't talking about the *device* having a password / pin, he's talking about the marketplace & in-app transactions not *seperately* requiring a password / pin prior to taking payment.

Incidentally, AFAIK you can set up multiple google accounts on one android device, so presumably (although I haven't played with this yet) you can switch the primary account whilst you're using the device. So (I assume, anyway) you could set up a new google account that *doesn't* have a google checkout linked to it then switch to that account when you give the kids the tablet - hopefully preventing them from randomly spending your money.

[Pancake]

Why not have a pin for the device? is OP going to start complaining you can make calls from a phone without a PIN?

[scaryjim]

OP got the tablet so his children could play on it so whether the device can have a PIN or not is irrelevant - if it did the OP would still have to unlock it so his child could use it. The OP is raising a reasonable point about in-game transactions being automatically paid via the linked google checkout account, which is something people letting a child play on their Android tablet should know about.

When you have an android device your google account is automatically authenticated to it, and apparently it automatically passes that authentication through to all google services that are accessed through it - including google checkout. On the other hand, that means that any app that uses google checkout can - presumably - be used to take money from someone's android device? I'm not sure if that's correct, as I've never paid for anything on my android devices, but it certainly doesn't sound right... surely there'd have been an attack using that vector by now if it was? *shrug*

Anyway,as I said before, the OP is making a specific point about Android Market and in-app transactions not re-authenticating before taking money from google checkout, and whilst I'm not necessarily saying I agree with his point, I think it's a fair one for him to be making.

[Hoonigan]

Oohhhh, they can buy apps on your google account! what gain would they even get from that? you would own the apps.

If your phone gets stolen, and your stupid enough to not have a pin/password/pattern on the phone just change your gmail account password, or call your bank? perhaps Android is a little to complicated for some users

Well, let me widen your mind a little, seeing as you're incapable of thinking outside the box

You're on a night out, you get pretty drunk and lose your phone, someone finds your phone and realises you have your CC/DC details stored in the phone and thinks it'd be funny to run up a huge debt, just because they can.

12 hours later, you wake up, in a groggy state, and realise your phone is gone.

Even iOS needs a password to make purchases, but Android, which almost everyone argues is superior, will allow anyone to make purchases on your card.

Laughable.

P.S. Android fanboy? Making up excuses for a blatant loophole in the OS.

[Pancake]

You dont have your CC/DC details on the phone though... And its not a loophole as you CAN set a pin/pass.

What this then? Took on my HTC Desire running ANDROID not a few mins ago

[jim]

3) They have acknowledged that the lack of any password/PIN protection is a bad thing (they fixed that in September) and yet they continue to ship an ancient version of Market (with Android 3.2), that doesn't support the feature.

Even iOS needs a password to make purchases, but Android, which almost everyone argues is superior, will allow anyone to make purchases on your card.

So no, it doesn't.

[Hoonigan]

You dont have your CC/DC details on the phone though... And its not a loophole as you CAN set a pin/pass.

But your card can be used to make payments. I know that on the Apple App Store, there are some games with additional in-game items that you can buy that cost upto £70. It'd take me about a minute to rack up that kind of debt onto someone's card if I found an iPhone and they didn't require a password.

This is a tech site, and you obviously think "well I know how to do it, so everyone should" but that REALLY isn't the case in the real world. Passwords should be there to start with, for you to remove if you wish.

[Pancake]

And the fact of the matter is that you can lock the whole phone anyway, so i dont get why OP doesnt have a problem with being able to call and text without a pin? calling an 0845 will cost looooaaadssss

This is a tech site, and you obviously think "well I know how to do it, so everyone should" but that REALLY isn't the case in the real world. Passwords should be there to start with, for you to remove if you wish

Its not hard to find, and Android is not like that. Its about using what YOU want, not what someone thinks you should use like with any Apple device

[peterb]

There is a wider issue here though, in that Google is linking different activitjes into one homogonous application. The OP used his credit card legitimately to make a payment through Google Pay.

Google (if my understanding of the first post is correct) then linked that card with his android account, without the OP's permission.

Google may say they can/will do that in the small print of their T&Cs, but I'm not sure that many people will realise the implications.