Strange security problem?

[MikeInMexico]

My Moto G7+ just updated to Android 10. Apart from the mess that is Android 10, a strange thing occurred. As soon as the update was complete, there were two downloads of annual statements from my broker. I had not opened their app, or logged in in any way.
Any clues as to why this happened?

 

[The_Chief]

Hola, Mike!

I'm not sure what causes you to call Android 10 a "mess" - I consider it a fantastic update to Android 9. As far as the statements go, you can rest assured Android 10 didn't go out there and fetch those statements for you. However, it IS the end of January / beginning of February, when tax statements are due from the various financial institutions and charitable organizations with which we are connected. Where were these statements downloaded TO? What folder? And was your account somehow set up for them to push those to you annually?

 

[MikeInMexico]

Hola, Mike!

I'm not sure what causes you to call Android 10 a "mess" - I consider it a fantastic update to Android 9. As far as the statements go, you can rest assured Android 10 didn't go out there and fetch those statements for you. However, it IS the end of January / beginning of February, when tax statements are due from the various financial institutions and charitable organizations with which we are connected. Where were these statements downloaded TO? What folder? And was your account somehow set up for them to push those to you annually?

Hola Chief,
Mostly the mess was caused by Nova Launcher. They tell me that Google has not supported some of their features in 10. The files were sent to my Download folder. I have never had the broker push files to me, even if I knew how to do that. I have consented to "e-delivery" but this is done with an email. I have not given them my cell number. Strange.

 

[The_Chief]

That is really odd, that those statements would be downloaded without your consent. Makes me wonder if you can contact your broker's IT dept and have them investigate the method by which they were delivered.

Okay, so the "mess" is thanks to Nova Launcher, not Android 10, for not optimizing their app for the new OS before it rolled out. I don't use a 3rd party launcher, so I'm perfectly happy with it.

 

[MikeInMexico]

That is really odd, that those statements would be downloaded without your consent. Makes me wonder if you can contact your broker's IT dept and have them investigate the method by which they were delivered.

Okay, so the "mess" is thanks to Nova Launcher, not Android 10, for not optimizing their app for the new OS before it rolled out. I don't use a 3rd party launcher, so I'm perfectly happy with it.

I will talk to the broker tomorrow to investigate.
The developer of Nova launcher gave this as a repose to my complaints:
https://help.teslacoilapps.com/faq/gesture-navigation

 

[The_Chief]

Whoops! Nope, gesture navigation works quite well on Android 10 straight up. I guess the question you want to ask yourself at this point is: "what benefit did I get from Nova Launcher that I liked enough to keep it; and what benefit does it now provide that Android 10 does not?"

 

[MoodyBlues]

Does their app stay running in the background, MikeInMexico? And/or are its settings such that it can push alerts?

I'm thinking of apps I use, e.g., American Express, Discover, Bank of America--they don't have to be visibly running in order to send alerts.

Sometimes when an app gets updated, its settings change on their own--much to my displeasure, since I finely tweak things and want them to work exactly right! Perhaps your app updated and changed its settings, or the Android update somehow did that.

I'd suggest going into its settings and checking how alerts are handled. You may have the choice, as I do in this example from my BofA account, to set both push and e-mail notifications:

You may have set statements to be sent via e-mail, then an update changed it for you...how thoughtful of them...

 

[Hadron]

Actually the gesture navigation works fine with Nova if you are on a sufficiently recent version of android 10. It didn't originally, but the system update one or two months ago fixed the problem.

Of course if Moto's release is based on an older version of android 10 you will have the problem. But it's easy to tell: if the phone won't allow you to enable gestures while using Nova they've used an older base. But if they don't you are no worse off than android 9 (at least I still had both of the android 9 options on my Pixel), and TBH the gestures are not that well thought through.

This was actually an android problem rather than a Nova problem though: Google had been very Google and thought only about their own launcher, realised part-way through the betas that they way they implemented the home gesture was tied exclusively to their launcher, and "fixed" it by disabling it with other launchers "until a future update" (which came a month or two back).

Incidentally Nova (even the beta I use) still has a message in its settings about gestures not working with android 10 until Google fix it. I was wondering why that hadn't been removed, but now realise its probably because phones who get updates less frequently than the Pixels are probably still on the unpatched 10.

 

[MikeInMexico]

Does their app stay running in the background, MikeInMexico? And/or are its settings such that it can push alerts?

..... snip ....

You may have set statements to be sent via e-mail, then an update changed it for you...how thoughtful of them...

This does not involve alerts ... .PDF files were actually downloaded. This occurred immediately after the system update. I had not even opened any apps, let alone logged in. I was not aware that ANYONE could push files to my device without my consent. I will be talking to the broker today.

 

[MikeInMexico]

Actually the gesture navigation works fine with Nova if you are on a sufficiently recent version of android 10. It didn't originally, but the system update one or two months ago fixed the problem.

... snip ....

Actually my original problem was the "clear all" recents being absent. I have now found out that I can turn on gesture navigation, and when I do, "clear all"has reappeared!

 

[Hadron]

Actually my original problem was the "clear all" recents being absent. I have now found out that I can turn on gesture navigation, and when I do, "clear all"has reappeared!

The funny thing is that the" clear all" was always there for me with 10, but I remember another forum member (with the same device as me) having this. Unfortunately I can't remember the resolution. The irony is that I have not used the "clear all" function once in the past 3-4 years, so wouldn't care or notice if it did disappear, but I was never affected.

 

[MoodyBlues]

This does not involve alerts ... .PDF files were actually downloaded. This occurred immediately after the system update. I had not even opened any apps, let alone logged in. I was not aware that ANYONE could push files to my device without my consent. I will be talking to the broker today.

Sorry, I guess I wasn't clear.

*If* the app has settings for sending statements, and *if* those settings include one to download them to your device, and *if* an update changed that setting to on, then that may explain what happened.

As I stated earlier, an app does -not- need to be opened, touched, or logged in to in order to push data your device--if its settings allow it.

Therefore, checking its settings is where I'd start.

 

[MikeInMexico]

The app (Edward Jones) has no option to push documents.

 

[MoodyBlues]

The app (Edward Jones) has no option to push documents.

Oh, okay. That answers that possibility!

 

[puppykickr]

There may be a permission on the app itself, namely 'Download Files Without Notification'.

This is a particularly scary permission, as the name of it implies exactly what it can do.

This is a permission that can be used for both good and bad.

If the app has this permission, there is a possibility that you may be able to disable it in the phone's app settings for that app- but there may not be any control over it in the app settings within the app.