Security & Privacy Analysis

This page analyzes the security and privacy implications of the Huepar app based on APK decompilation and protocol analysis.

Critical Finding

The Huepar app requests full Google Drive access but shows no evidence of actually using it. If you’ve used Google Sign-In, you should revoke access immediately.

Risk Assessment

Risk Level	Category
MODERATE-HIGH	Overall Privacy Risk
HIGH	Google Sign-In Users
LOW	Offline-Only Users

Google Drive Scope Issue

The Problem

The app requests the most permissive Google Drive OAuth scope:

{
  scopes: ['https://www.googleapis.com/auth/drive']  // FULL access!
}

Scope	Access Level	Used by Huepar
drive.appdata	Hidden app folder only	No
drive.file	Only files created by app	No
drive.readonly	Read-only access	No
drive	Full read/write/delete	Yes

What We Found

After extensive analysis of the decompiled APK:

• No Google Drive API calls exist in the code
• No backup/restore features using Drive
• No file sync functionality
• The OAuth token is sent to Huepar’s backend server

Why This Is Dangerous

┌─────────────┐     OAuth Token      ┌─────────────┐
│   Your      │  (with Drive scope)  │   Huepar    │
│   Phone     │ ───────────────────► │   Backend   │
└─────────────┘                      └─────────────┘
                                            │
                                            │ Could access:
                                            ▼
                                     ┌─────────────┐
                                     │ Your Google │
                                     │   Drive     │
                                     │  (ALL files)│
                                     └─────────────┘

The Huepar backend receives a token that could be used to:

• Read any file in your Google Drive
• Download your personal documents
• Modify or delete files
• Access shared files and folders

Immediate Action

If you’ve used Google Sign-In with this app:

1. Go to Google Account Permissions
2. Find “Huepar” or apps with client ID 218951563723-*
3. Click Remove Access
4. The app still works - use email/password login instead

BLE Protocol Security

Good Practices

Aspect	Assessment
No pairing required	Reduces attack surface
Local-only BLE	Data stays on device
Simple protocol	Less room for bugs

Concerns

Issue	Risk	Details
No encryption	Medium	BLE data transmitted in plaintext
No authentication	Medium	Anyone in range can send commands
MAC in device name	Low	Device name contains last 4 digits of MAC

Note

The lack of BLE encryption is common for simple measurement devices. The main risk is someone nearby triggering measurements or changing settings - not data theft.

Backend Infrastructure

Data Storage

Service	Location	Purpose
app.huepar.com	Unknown	User accounts, API
Tencent Cloud (qcloudCos)	China	Avatar images, post attachments

Caution

Tencent Cloud is a China-based service. Uploaded files (avatars, forum posts) may be stored on servers subject to Chinese data laws.

Data Collection

Based on React Native modules in the APK:

Data Type	When Collected
Battery level	Device connection
Device brand/model	App launch
Network state	App launch
BLE device MAC	Device connection

Android Permissions

Permission	Purpose	Risk
BLUETOOTH_*	Device control	Low
ACCESS_FINE_LOCATION	BLE scanning (Android 12+)	Medium
CAMERA	Camera measurement mode	Medium
RECORD_AUDIO	Voice commands	Medium
READ_PHONE_STATE	Device identification	Medium

Tip

Location permission is required by Android for BLE scanning, not for GPS tracking. This is a platform limitation, not app malice.

Third-Party Services

Service	Purpose	Privacy Impact
Google Sign-In	Auth	HIGH Full Drive access
Apple Sign-In	Auth	LOW Standard scope
Tencent Cloud	Storage	MEDIUM China-based
Google Translate	UI strings	LOW Minor

Recommendations

For Maximum Privacy

1. Use offline mode - Measurement works without network
2. Skip account creation - Use “temporary” mode
3. Disable network - Turn off WiFi/data when using app
4. Revoke Google access - If you ever used Google Sign-In

If You Need an Account

1. Use Apple Sign-In - Standard permissions only
2. Use email/password - Avoid OAuth entirely
3. Don’t use social features - Forum posts are stored on Tencent

For BLE Usage

1. Power off when not in use - Device is always discoverable
2. Use in private spaces - Anyone nearby can interact with device

Analysis Methodology

This analysis was performed by:

1. APK Decompilation - Hermes bytecode → readable JavaScript
2. Static Analysis - Searching for API calls, OAuth scopes, URLs
3. Live Testing - Capturing actual BLE and network traffic
4. API Probing - Testing backend endpoints

Files Analyzed

File	Size	Contents
huepar_decompiled.js	37 MB	React Native bundle
AndroidManifest.xml	6 KB	Permissions, activities
btsnoop captures	~50 KB	BLE packet traces

Related Pages

• OEM Ecosystem - Multi-brand platform implications
• API Endpoints Reference - Backend API documentation