Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikipedia Android app now requests identity permissions

plus.google.com

Post reply on HN
Print view View original

1–10 of 43 posts

Re: Wikipedia Android app now requests identity permissions

#2

Post by dkopi »

This reads to me as an overreaction. Sure, it's important to be vigilant about the permissions you give apps, but it's also important to understand the underlying OS and permission layers.

TLDR: If you're concerned about your privacy, upgrade to Android 6.0

There's nothing wrong with Wikipedia letting you manage your Wikipedia account using the app. They're using the Account Manager API, which is the right way to approach account management on android. Prior to android 6.0, they need the GET_ACCOUNTS permission to use the account manager.

Wikipedia's FAQ explains: Note: The app does not store your Wikipedia login credentials on the device, and it does not access any non-Wikipedia accounts on your device, nor any other aspects of your identity. Note: This permission is only required in Android versions earlier than 6.0 (Marshmallow). For Android 6.0 and above, this permission is not required.

GET_ACCOUNTS is a dangerous permission. That's why google changed the behavior in android 6.0 by: 1. Allowing users to decline specific permissions to apps, instead of the "accept all or none" approach in lollipop and bellow. 2. Allowing apps to manage the account they own without requesting GET_ACCOUNTS.

The Android docs explain this as well: Note: Beginning with Android 6.0 (API level 23), if an app shares the signature of the authenticator that manages an account, it does not need "GET_ACCOUNTS" permission to read information about that account. On Android 5.1 and lower, all apps need "GET_ACCOUNTS" permission to read information about any account.

Bottom line is: if you're concerned about app permissions (as you should be) - you should be running Android 6. Wikipedia won't ask you for GET_ACCOUNTS, and you'll be able to manually control permissions other apps receive as well.

Re: Wikipedia Android app now requests identity permissions

#3

Post by butz »

dkopi wrote: post #2

This reads to me as an overreaction. Sure, it's important to be vigilant about the permissions you give apps, but it's also important to understand the underlying OS and permission layers. TLDR: If you're concerned about your privacy, upgrade to Android 6.0 There's nothing wrong with Wikipedia letting you manage your Wikipedia account using the app. They're using the Account Manager API, which is the right way to app…

> upgrade to Android 6.0 That usually means buying a new phone.

Re: Wikipedia Android app now requests identity permissions

#5

Post by joelhaasnoot »

dkopi wrote: post #2

This reads to me as an overreaction. Sure, it's important to be vigilant about the permissions you give apps, but it's also important to understand the underlying OS and permission layers. TLDR: If you're concerned about your privacy, upgrade to Android 6.0 There's nothing wrong with Wikipedia letting you manage your Wikipedia account using the app. They're using the Account Manager API, which is the right way to app…

The Android 6.0 version is better in some ways, but has its issues. For instance, in Android 6.0 the Internet permission is assumed. For the truly privacy conscious, the best internet is no internet.

There is something 'clean' about building an app without internet access. I created an app with schedule data that's updated every two months. With no need for regular updating, updates are distributed as app updates. The app was created in a weekend: no backend services to create or maintain.

Re: Wikipedia Android app now requests identity permissions

#6

Post by AdmiralAsshat »

dkopi wrote: post #2

This reads to me as an overreaction. Sure, it's important to be vigilant about the permissions you give apps, but it's also important to understand the underlying OS and permission layers. TLDR: If you're concerned about your privacy, upgrade to Android 6.0 There's nothing wrong with Wikipedia letting you manage your Wikipedia account using the app. They're using the Account Manager API, which is the right way to app…

Less than 5% of phones currently run Android 6.x. I don't really think that's a fair "requirement" to give to people, given that many people are otherwise prevented from getting a Marshmallow update not because of the age or model of their phones, but because the carrier has prevented it.

Re: Wikipedia Android app now requests identity permissions

#7

Post by pki »

AdmiralAsshat wrote: post #6
dkopi wrote: post #2

This reads to me as an overreaction. Sure, it's important to be vigilant about the permissions you give apps, but it's also important to understand the underlying OS and permission layers. TLDR: If you're concerned about your privacy, upgrade to Android 6.0 There's nothing wrong with Wikipedia letting you manage your Wikipedia account using the app. They're using the Account Manager API, which is the right way to app…

Less than 5% of phones currently run Android 6.x. I don't really think that's a fair "requirement" to give to people, given that many people are otherwise prevented from getting a Marshmallow update not because of the age or model of their phones, but because the carrier has prevented it.

then we get into the whole "at what point do we stop supporting windows xp for real this time guys" argument though..

Re: Wikipedia Android app now requests identity permissions

#8

Post by AdmiralAsshat »

pki wrote: post #7
AdmiralAsshat wrote: post #6

Earlier quoted context omitted.

Less than 5% of phones currently run Android 6.x. I don't really think that's a fair "requirement" to give to people, given that many people are otherwise prevented from getting a Marshmallow update not because of the age or model of their phones, but because the carrier has prevented it.

then we get into the whole "at what point do we stop supporting windows xp for real this time guys" argument though..

There's a big difference between a 10 year-old OS and a two-year old phone, though. Especially if the unlocked model of the phone has received a Marshmallow update, but your carrier decides they don't feel like going through the cert process for that when they could easily twist your arm to getting a nice, new $750 phone instead.

Re: Wikipedia Android app now requests identity permissions

#9

Post by pramodliv1 »

dkopi wrote: post #2

This reads to me as an overreaction. Sure, it's important to be vigilant about the permissions you give apps, but it's also important to understand the underlying OS and permission layers. TLDR: If you're concerned about your privacy, upgrade to Android 6.0 There's nothing wrong with Wikipedia letting you manage your Wikipedia account using the app. They're using the Account Manager API, which is the right way to app…

Also, since the code is open sourced (https://github.com/wikimedia/apps-android-wikipedia), I guess they get the benefit of the doubt?
Post reply on HN