Osmand collects Android ad ID and sends unencrypted

[securesearch]

Realise Osmand isn't bundled, but since you recommended it, maybe should just put it out there or let users know about it.

When connected to a network, Osmand tries to contact osmand.net every time you open the app, and when explicitly downloading maps, download.osmand.net.

All requests include the Android ad ID (sure, not the serial number, but still potentially sensitive) and sends them over an unencrypted connection.

Sanitized example (notice "aid=XXXXXXXXXXXXXXXX"):

GET /?gzip&osmandver=OsmAnd%7E+2.5.4&nd=XX&ns=XX&aid=XXXXXXXXXXXXXXXX HTTP/1.1
User-Agent: Dalvik/ (Linux; U; Android ; "" Build/XXXXXX)
Host: download.osmand.net
Connection: Keep-Alive
Accept-Encoding: gzip

[thestinger]

Please report this to F-Droid instead so they can mark it in the repository.

https://gitlab.com/fdroid/fdroiddata

[thestinger]

Please report this to F-Droid instead so they can mark it in the repository.

https://gitlab.com/fdroid/fdroiddata

[thestinger]

I added a note to our documentation about it too. All I can say is that it's very unfortunate that there's barely any community of people working with us to reach our goals.

[thestinger]

I added a note to our documentation about it too. All I can say is that it's very unfortunate that there's barely any community of people working with us to reach our goals.