security warning about 喜马拉雅 Android app

[大块头]

I've been using the Ximalaya podcasting app for more than a year now after installing it via the Baidu app store. Recently Android has started showing me warnings about the security of this app (see images below).

 

I'm not sure if this is relevant, but the app also recently changed it's name to "CoreService" and modified its icon to advertise a sales promotion called “66会员日”.

 

Has anybody else experienced similar warnings? Does Android show these warnings about any app that didn't originally come from the Google Play Store?

[Geiko]

I also received a warning today, although my icon hasn't changed and I installed the app via google play some months ago. 

[Luxi]

My iPad doesn't give me any warning. The app was updated on 3 June, the UI has changed a bit, mainly to display big adds for speakers looking like a Sonos clone. It's all working OK 

I just checked the website in chrome, and the Windows 10 app, no warning for either of them. If there was anything sinister afoot, I would have got a warning, at least from the Windows embedded nanny.

When I had a working Android, I used to get warnings for the Duokan app, but that was because I hadn't installed it from the Google Play store (where it was unavailable).

 

[艾墨本]

I got the same warning and promptly uninstalled it.

 

Edit: Android and installed through baidu.

[大块头]

42 minutes ago, 艾墨本 said:

I got the same warning and promptly uninstalled it.

 

Ugh, but a few podcasts I like are only available through this app... How does Google decide an app is unsafe?

 

11 hours ago, Geiko said:

I also received a warning today, although my icon hasn't changed and I installed the app via google play some months ago. 

 

Are you using the latest version of the app?

[艾墨本]

1 hour ago, 大块头 said:

Ugh, but a few podcasts I like are only available through this app... How does Google decide an app is unsafe?

Are you using the latest version of the app?

 

 

Yeah, me too. I listen to several audio books on it as well. Really sucked.

 

I believe so considering I had restarted my phone and installed fresh just a week prior. That said, it's uninstalled now so I have no way to be sure.

[imron]

3 hours ago, 大块头 said:

but a few podcasts I like are only available through this app.

Are they not available on the site itself?

[Luxi]

2 hours ago, imron said:

Are they not available on the site itself?

Everything is available through Himalaya's web site, accessible through any browser. Unfortunately, the app is the only way to download and listen offline.

 

About the warning, there are free apps that will analyse your downloads for security and tell you exactly what permissions they assume and what they can do to your device or data in it. I've been using Lookout for many years and it's never failed me. It's a must to have not only anti-virus but also fuller security suites in Android, there are many good free ones.

 

I was curious as neither Apple nor Microsoft give me any warnings on Ximalaya at all. I resurrected an old Google phone to test it. I downloadedfrom the Ximalaya website and had to go through a series of warnings from Google. Once downloaded, I ran Lookout and got a rundown of the privacy and other security issues - quite a few, to be honest, but no worse than many other apps. After the security check I got the choice to Install or Cancel. When I went for Install I got Google's last warning, which I think was rather revealing. It said that the app was capable of passing your private data to third parties. 

If it hadn't been China, I would have freaked out there. But being China and coincidentally a few days after Xi's latest Cyber-security Law, I suspect those 'Third Parties' in the warning are the Chinese government and all Chinese apps are going have the same issues.

https://www.theregister.co.uk/2017/06/01/china_cybersecurity_law/.

There may well be a 'tit-for-tat' aspect here too, Microsoft and Apple do business in China - no warning with the very same privacy issues.

I'll leave Ximalaya installed in this Google device and keep an eye on it,

 

[Publius]

On 6/21/2017 at 5:07 PM, Luxi said:

Unfortunately, the app is the only way to download and listen offline.

Not true. Many browser extensions are able to sniff out the source of streaming media and allow you to download the stream directly as a file. I use Firefox + FlashGot to download anything from random audio clips to YouTube videos. Some sites go to extreme length to protect their media. But 1) Ximalaya isn't one of them; 2) theoretically, if it's playable, it's downloadable.

I just downloaded the first thing I saw: 088 优秀的人才是免费的 by：许锋博士

 

[Luxi]

Great! I hadn't thought of trying, I haven't used Firefox for a long time, I'd forgotten about its infinite resources.

[大块头]

2 hours ago, Publius said:

I use Firefox + FlashGot

 

Thanks Publius.

 

For anyone (like me) who has never used FlashGot before:

 

After you've installed the add-on, go to Ximalaya and start playing the specific podcast you want to download. Once it's playing you should see a flashing icon (see screenshot) in your Firefox toolbar. Click it to download the podcast as a m4a file. It appears that you can download multiple podcast files by starting playback of several files (listening to the first couple of seconds are enough) and then clicking the flashing icon.

[大块头]

It looks like many of the podcasts on Ximalaya are also available via other podcast distribution channels. For example, I'm able to download episodes of 《原来是这样》 with Podcast Addict. It's worth searching for the podcast with your app of choice before trying to skim it off the Ximalaya website.