I am fully aware of what vpn services to use and not. I am not using Express VPN, I am simply doing research for a master thesis, when I came across these results from Express VPN. If you have any ideas or corrections, please let me know why a VPN provider would need to have access to these permissions.

Screenshot is from Exodus service, which let’s you view what exactly perimissions and trackers each app uses. You can check out the results and the tool for yourself here: https://reports.exodus-privacy.eu.org/en/reports/com.expressvpn.vpn/latest/

Link to Image

  • winterayars@sh.itjust.works
    1221·
    2 years ago

    Camera could be taking pictures of QR codes to make it easier to set up a VPN.

    Bluetooth could be integration with things like Yubikeys for authentication.

    Dunno if that’s what they’re actually for, though.

    • BuddyTheBeefalo@lemmy.ml
      512·
      2 years ago

      Best practices would not require camera permissions to scan qr codes.

      Scan barcodes

      Android includes support for the Google Code Scanner API, powered by Google Play services, which allows you to decode barcodes without declaring any camera permissions. This API helps preserve user privacy and makes it less likely that you need to create a custom UI for your barcode-scanning use case.

      The API scans the barcode and only returns the scan results to your app. Images are processed on-device, and Google doesn’t store any data or scan results.

      https://developer.android.com/privacy-and-security/minimize-permission-requests

      • meseek #2982@lemmy.ca
        22·
        2 years ago

        I’m going to assume they didn’t implement this because money. Their app runs on everything, from iOS to Android to Windows. Cost savings they likely just flipped camera permissions and didn’t care about small edge cases like these.

        With that said, Mullvad is a million times better, cheaper and doesn’t require even an email or account creation to use. They created a system that effectively anonymizes the user before they even subscribe.

      • ricecake@sh.itjust.works
        10·
        2 years ago

        To be fair, they didn’t offer that level of granular control for a while.
        If you’re a company with development prioritization that makes it difficult to say “we need to take a few weeks of not working of things that make money to reimplement something we already have that works, because of best practices that don’t make us any money” then it can be really difficult to make changes like that.

      • Aux@lemmy.worldBanned
        73·
        2 years ago

        You don’t want to scan secure QR codes through Google APIs. You can be at risk of Google stealing the contents.

            • uis@lemmy.world
              1·
              2 years ago

              Doesn’t it use IPC? So only separately installed barcode scanner needs camera.

              • Aux@lemmy.worldBanned
                1·
                2 years ago

                Mate, you need to give access rights to someone. The camera won’t open magically. The reality is that it’s safer to do everything inside your app, especially when you advertise security.

    • Lunch@lemmy.worldOP
      131·
      2 years ago

      Ah okay that might justify the camera permission, although personally wouldn’t see the need to have that.

  • meseek #2982@lemmy.ca
    714·
    2 years ago

    I don’t get why the entire world isn’t on Mullvad.

    I don’t trust these guys at all. I trialed them and despite their full money back guarantee, they locked me into a support loop, always switching support staff with boiler plate responses and links that dealt with account issues or whatever. It wasn’t until I left a stern reply demanding the refund or I would escalate the matter with the proper regulatory bodies.

    It took 4 support tickets. To me, they came across hella shady.

  • extant@lemmy.worldEnglish
    281·
    2 years ago

    I use Express VPN and the camera permission is relatively new as I don’t have it enabled and it’s never asked me prior to enable it. I dug through the app and found it within their new password manager when you add a new credentials it offers you to help setup 2FA with the major providers and you can optionally scan a QR code with it so it’s a benign convenience feature.

    Bluetooth on the other hand I cannot explain unless it’s to proxy any connections Bluetooth devices might make.

  • MigratingtoLemmy@lemmy.world
    27·
    2 years ago

    Wait, are you the same guy I asked for access to your draft when you’re done?

    How is the paper going? Will you also be covering self-hosted VPNs in your thesis? Also, SSL-VPNs seem to be coming up nicely, so if you’re interested in obfuscation, that might be interesting to you! Can’t wait to read what you’re cooking!

    • Lunch@lemmy.worldOP
      24·
      2 years ago

      Hahah thats me! :P (lemmy is a small world) My main focus is most likely going to be free vpn’s and the risk of using them. I have to limit the scope quite a bit and want to cover areas that are not that well properly documented… yet…

      But thanks for the tips! I will defo read up on it and see wheter or not I can have a “alternatives” section towards the end.

      Edit -> This research paper might feed your temporary needs :P https://www.usenix.org/system/files/usenixsecurity23-ramesh-vpn.pdf

  • ekky43@lemmy.dbzer0.com
    22·
    2 years ago

    Dunno about Bluetooth, but isn’t Expressvpn pushing their new password manager? I imagine it’s a separate app, but if not, then it would make sense to have camera to read 2FA QR-codes.

    Edit: from their site:

    Keys comes included in any ExpressVPN subscription and is built right in to our apps for iOS and Android.

    Yup, that’s got to be the camera. Still not sure about the Bluetooth though.

  • fubarx@lemmy.ml
    191·
    2 years ago

    There are Bluetooth FIDO security keys out there for 2FA, like: https://thetis.io/products/fido2-ble-security-key. Some implementations can also use a phone, running an app via BLE. Not sure if they use it, but that could be one reason it’s asking for that permission.

    Camera permission may be needed for scanning QRCodes to set up 2FA.

  • Omega_Haxors@lemmy.ml
    181·
    2 years ago

    If handfuls of youtube sponsor callout videos has been proof of, is that you should never use a service advertised on youtube.

  • thepiguy@lemmy.ml
    123·
    2 years ago

    I prefer mullvad. Not only is their pricing and account system much more privacy focused, they are a European (Swedish) company and are bound by the laws of my country by default. Another European one is surfshark (Dutch) which I used before. I trust mullvad more though. They also have open source clients and had no user data stored when they were raided once before.

    Edit: clarifying the reason I used surfshark. I used it back when I was in high school a few years ago, so their 3 year plan seemed like a very good price. They also supported this very obscure VPN protocol whose name I can’t remember, and my school just so happened to have forgotten to block it on their network. But I couldn’t use that protocol on Linux due to incomplete connection steps provided by surfshark, and I switched to using linux full time in the second half of my first year, so that was a waste and I just used my mobile data.

  • lemmyworld2023@lemmy.world
    71·
    2 years ago

    In the mobile space, there are Chinese calculators apps on Androids by manufacturers that require internet access…

  • LWD@lemm.ee
    5·
    2 years ago

    I know the camera permission can be explicitly denied by you, and the app can’t work around that. As for Bluetooth, I think it’s the same story, although I haven’t checked …

    This isn’t an endorsement of the VPN service, as other people have pointed out it has some issues