Paranoia: ES File Explorer

jefboyardee · Jun 8, 2012

Google has been listening, or so they say: Google Authenticator

Google Authenticator has these concerns:
No concerns
Google Authenticator requires these permissions:
Hardware controls
control vibrator

I haven’t tried it, but someone will?

dylo22 · Jun 9, 2012

kristalsoldier said:
That kind of biasness is somewhat counter-productive in the commercial space. Thus, for example, if I laboured under a similar biasness, I would not be able to use my favoured laptop - ThinkPads!

I don't think it's counter-productive. It's in his best interest to keep his data secure, so it's right for him to question and be skeptical of what he install on his phone, especially if its coming out a country that has a history of spying.

kristalsoldier · Jun 9, 2012

dylo22 said:
I don't think it's counter-productive. It's in his best interest to keep his data secure, so it's right for him to question and be skeptical of what he install on his phone, especially if its coming out a country that has a history of spying.

Without belabouring the point. please understand that the USG is probably better known for activities of this sort. But then your (and the OP's) perspectives may vary and, frankly, I am no-one to point such things out.

NeoMoa · Jun 9, 2012

jefboyardee said:
Google has been listening, or so they say: Google Authenticator

...

I haven

NeoMoa · Jun 9, 2012

As suggested by Hadron, I’ve rooted my phone and installed a firewall (DroidWall) and also a sniffer (Packet Sniffer - https://sites.google.com/site/androidarts/packet-sniffer ).

No strange connections reported so far but as I write in a previous post, I can’t prove a negative so this don’t means the app will not connect in other circumstances.

The only true security would be to examine the source code and this could only be done by Google.

NeoMoa · Jun 9, 2012

kristalsoldier said:
That kind of biasness is somewhat counter-productive in the commercial space. Thus, for example, if I laboured under a similar biasness, I would not be able to use my favoured laptop - ThinkPads

Yes, quite subjective but we make it every day at every moment, for example when we trust much or less a person (part of it unconsciously) on its aspect. That

MK27 · Jun 9, 2012

Your paranoia seems to hinge on the fact that you don't understand how EStrong makes money. l doubt somehow that if they were a front, they wouldn't have covered that angle.

A company with a reputation like that is probably in enough demand to make commercial apps for other people (eg. "We want someone to write an iphone and android app we can give to our customers as an addition to our already strong web presence."). You won't see those for sale somewhere or with the EStrong brand name on them. Ie., like most small software houses they make money off contract work, not retailing.

If android is one of their specialties, maintaining popular free apps looks good and provides them with creative freedom and the opportunity to develop components/code they can reuse elsewhere after they have undergone widescale public testing. That is not to imply you are a guinea pig, that there are unusual risks involved, or that the free software is not properly maintained (the idea is that it is) as this is a natural and normal practice of the software industry used by everyone from MS on down. Remember, this is also how the open source movement that has nurtured linux so well works. It contributes to higher quality product all round, so don't worry, be happy.

NeoMoa · Jun 9, 2012

MK27 said:
Your paranoia seems to hinge on the fact that you don't understand how EStrong makes money. l doubt somehow that if they were a front, they wouldn't have covered that angle.

Yes, this is the sole argument right now that doesn

MK27 · Jun 9, 2012

NeoMoa said:
If you are a startup (even if you aren’t), you need money. Who, and why, needing money and making an app of such quality with 30 million installations resists the temptation of making a ‘Pro’ paid version?

You are begging a number of questions:
1) That a company with 5-10 employees which has survived for a number of years is a "start-up", as opposed to just a successful small business.

2) That suddenly releasing a "Pro" version of an already successful freeware project will generate much revenue, keeping in mind that some of that revenue will be eaten up by the additional expenses incurred by customer support, etc. This may simply be an avenue they've considered and decided is not worthwhile. Also keep in mind they would have to maintain both versions. Evidently they do not retail COTS ("consumer-off-the-shelf") software and don't see it as a worthwhile area to expand into right now.

3) That this would not hurt the reputation of the original product, which may be worth more to them than a retail opportunity. If Linus Torvalds had, 20 years ago, decided to release a "pro" version of the linux kernel, you'd probably never have heard of either of them now. But despite having never charged anyone a penny for the product, today he is a very, very rich man.

joshua.worth · Jun 9, 2012

I really think the OP is on to something no one works for free and if it's not ad supported how is it supported. If it's on a grand scale then they could easily go undetected for years. Power Users I know of all use Root Explorer which costs $3.99

joshua.worth · Jun 9, 2012

MK27 said:
Your paranoia seems to hinge on the fact that you don't understand how EStrong makes money. l doubt somehow that if they were a front, they wouldn't have covered that angle.

A company with a reputation like that is probably in enough demand to make commercial apps for other people (eg. "We want someone to write an iphone and android app we can give to our customers as an addition to our already strong web presence."). You won't see those for sale somewhere or with the EStrong brand name on them. Ie., like most small software houses they make money off contract work, not retailing.

If android is one of their specialties, maintaining popular free apps looks good and provides them with creative freedom and the opportunity to develop components/code they can reuse elsewhere after they have undergone widescale public testing. That is not to imply you are a guinea pig, that there are unusual risks involved, or that the free software is not properly maintained (the idea is that it is) as this is a natural and normal practice of the software industry used by everyone from MS on down. Remember, this is also how the open source movement that has nurtured linux so well works. It contributes to higher quality product all round, so don't worry, be happy.

Uhm wrong just have a look at your boat ware it a comes with the developers names and all are readily available in the Play Store from said Devs...

Crashdamage · Jun 9, 2012

NeoMoa said:
The problem is their app seems too good to be free

jefboyardee · Jun 9, 2012

Crashdamage said:
I don't understand how anyone concerned about security would use Windows.

Or hand their credit card to a waitress at a restaurant they

lunatic59 · Jun 9, 2012

I think we have a fundamental breakdown in logic here. It seems there is a lot of speculation about a situation which can't be easily explained, so possible explanations are being offered with the focus being on negative nefarious purposes. That is the classic definition of FUD. The answer to the question about why Estrongs offers a useful and valuable app for free is that we don't know.

What conclusions we shouldn't be so hasty to jump to:

ES File Explorer doesn't generate profit or distributing it free doesn't provide value to Estrongs. For example, if this group of developers approaches a prospective client as the developer of the most popular file transfer app in the Android ecosystem, it would go a long way to a.) establish their credibility, and b.) permit them to charge higher rates for private development.
A company that does not divulge their business paradigm must be doing something nefarious. Frankly, any private company should be reluctant to tell Joe Internet how they make money.
Chinese companies are more suspect for proffering illicit activities than other area's of the world.
People who are concerned about security are paranoid.

Frankly it's an interesting question which no one seems to be able to definitively answer. Personally I feel the security risk is minimal. First, it is a widely used app, recommended by many developers and tech enthusiasts who are both security conscious and knowledgeable about the underpinnings of Android. If ES File Explorer were somehow compromising personal information, there would be some statistical data given the wide user base. Secondly, the risk to a legitimate business with recognized and popular products being labeled a malware developer is economic suicide. Finally, I have used several file management utilities, both free and paid, and ES File does not require and unique or unexplained permissions or run any services not in keeping with the purpose of the app.

At this point, if the company is unwilling to explain their business paradigm to your satisfaction (something, I will reiterate, they are under no obligation to do) you have the choice to use an app you are more comfortable with, either by using a free, ad supported file manager or a paid app.

MK27 · Jun 9, 2012

joshua.worth said:
I really think the OP is on to something no one works for free and if it's not ad supported how is it supported.

That's a model, not the model.

How does Adobe support the free flash player, from which they make absolutely NO revenue at all directly? How does Microsoft support the free IE browser, from which they make absolutely no revenue at all, directly?

The answer is not quite the same in those two cases and probably not quite the same in EStrong's case, but what all of them in common is that the free products fit into a more large scale business plan, and they best fulfill that role by being free products. I think if you look at the email EStrong sent the OP from post #20, and consider what I said about them (evidently) not being set-up to direct retail COTS ware, then their plan and how it makes sense might be a little clearer.

I also think you should consider who Chinese cyber-warfare intelligence units are and what they are interested in. They are not interested in your passwords, personal or financial information, etc. What they are interested in is establishing anonymous zombie networks for DOS attacks. I suppose you could do that this way, but it would be a very stupid way to go about it because 1) it would be easily detected, 2) subsequent to first use, the ease of detection would mean the whole enterprise is worthless, 3) it is more convoluted than existing, harder to detect methods.

In short it is not realistic that this is a military front. And with regard to them being just plain criminals, why would they bother? Evidently they have a successful business doing contract work for hardware companies and adware for other people (again, see post #20 -- I'm pretty impressed they replied in detail at all, I doubt most software companies, Chinese or otherwise, would bother, particularly if they had something to hide), they also have attracted investment capital, and have doubled in size in a short time. Why would they want to ruin that with a scam they would inevitably get caught out for?

kristalsoldier · Jun 9, 2012

To add to MK27's excellent post...in the country in which I currently reside, there have been - over the last couple of years - reports that Huawei (or at least some elements of that company) who conduct cyber intelligence operations against critical infrastructures. Mind you, as press articles, such reports need to be taken with a pinch of salt. But, there has been a concerted effort by the government (of the country in which I live) to deny Huawei sensitive government contract. Here is a link to an illustrative article. The section of interest in the article is titled "The Role of Cyber Companies".

Here is an illustrative quote:

A 2006 study from RAND Corporation reported that “Huawei maintains deep ties with the Chinese military, which serves a multifaceted role as an important customer, as well as Huawei’s political patron and research and development partner.”

(Ref: Evan S. Medeiros, Roger Cliff, Keith Crane, and James C. Mulvenon, A New Direction for China’s Defense Industry. This document is available here.

The point that I am trying to make is simply this - As MK27 pointed out, while it is true that Chinese cyber intel units are active - very active - they are also not idiots. They do plan and strategize. I don't think small outfits like EStrong are in the same league...yet. But who knows what the future holds.

At the moment all that we have to go on is when installing apps like ES File Explorer is to see if the permissions required are out-of-the-ordinary.

Btw, while I may have highlighted a Chinese example, my experience tells me that similar efforts are also conducted by various governments - including the US (especially in their military-grade equipment).

NeoMoa · Jun 9, 2012

MK27 and kristalsoldier:

As said by lunatic59, this kind of arguments can always be seen coherently from different points of view.
From my

lunatic59 · Jun 9, 2012

NeoMoa said:
My hopes were to have more objective responses based on technical facts but it seems that this will not be possible.

Unfortunately, it's difficult, if not impossible to prove a negative. The permissions you cite are common to all file management apps so there's nothing more or less sensitive than any other app that performs these functions. I doubt anyone is going to decompile the app and examine it line by line without anything more that a vague suspicion.

Were there any direct evidence of wrongdoing, the "facts" would be clear, but since there is no evidence of this, even in the minutest form, all we can say is that if they wanted to, it might be possible. Of course that would go for absolutely every app with file permissions.

kristalsoldier · Jun 9, 2012

NeoMoa said:
MK27 and kristalsoldier:

As said by lunatic59, this kind of arguments can always be seen coherently from different points of view.
From my

NeoMoa · Jun 9, 2012

lunatic59 said:
... The permissions you cite are common to all file management apps so there's nothing more or less sensitive than any other app that performs these functions. I doubt anyone is going to decompile the app and examine it line by line without anything more that a vague suspicion.

When file access was limited to a phone, damage could be less. Now with access to net shares on Pcs, DropBox, Skydrive, Google Drive, etc. that will become more and more used, we are at much higher level of risk.

I think Google will have to take some action and I imagine a source code inspection by their teams before to allow an app to be published could be possible, specifically referring to all the calls to net functions.

Meanwhile, we only can be confident with a precise dose of paranoia

kolosus · Jun 9, 2012

If we're going to start worrying about EStrongs we should start worrying about Go Dev Team too. Their launcher, messenger et all are all free. Free to use and they're free even "the pro version" as they like to put in their descriptions. Plus they are more used than ES File explorer.

Go Dev Team is also out of China and their products are closed source.

NeoMoa · Jun 9, 2012

kristalsoldier said:
While I am not a Chinese citizen and not even of Chinese descent , I take exception to assertions like the one I've highlighted in bold and I am not willing to be a part of a discussion that veers along such lines. Good luck to you.

Do you think is an offense to say that a Chinese is Chinese? Your ‘political correction’ makes you unable to see the simpliest facts. Perhaps I’m Chinese too, but I have no problems with this…

electricpete · Jun 9, 2012

I haven't read this thread far beyond the initial post...sorry of I repeat something.

What are the permissions?
If no ads, they should need no internet access.
If no internet access, can they steal any info?

NeoMoa · Jun 9, 2012

electricpete said:
I haven't read this thread far beyond the initial post...sorry of I repeat something.

What are the permissions?
If no ads, they should need no internet access.
If no internet access, can they steal any info?

lunatic59 · Jun 9, 2012

NeoMoa said:
When file access was limited to a phone, damage could be less. Now with access to net shares on Pcs, DropBox, Skydrive, Google Drive, etc. that will become more and more used, we are at much higher level of risk.

I think Google will have to take some action and I imagine a source code inspection by their teams before to allow an app to be published could be possible, specifically referring to all the calls to net functions.

Meanwhile, we only can be confident with a precise dose of paranoia

Paranoia: ES File Explorer

Extreme Android User

Android Enthusiast

Android Enthusiast

Newbie

Newbie

Newbie

Lurker

Newbie

Lurker

Android Enthusiast

Android Enthusiast

Android Expert

Extreme Android User

Moderati ergo sum

Lurker

Android Enthusiast

Newbie

Moderati ergo sum

Android Enthusiast

Newbie

Android Expert

Newbie

Android Expert

Newbie

Moderati ergo sum

BEST TECH IN 2023

Smartphones

Best Android Phones

Upcoming

Best iPhones

Upcoming

Tablets

Best Tablets

Upcoming

Laptops

Best Laptops

Upcoming

Televisions

Best TVs

Upcoming

Game Consoles

Best Game Consoles

Upcoming

Wearables

Best Wearables

Upcoming

Smart Home

Smart Home Tech

Upcoming

Similar threads