Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber wants access to browsing history, bookmarks, and running apps

reddit.com

Post reply on HN
Print view View original

211–220 of 257 posts

Re: Uber wants access to browsing history, bookmarks, and running apps

#211

Post by on_and_off »

matt_wulfeck wrote: post #49
StavrosK wrote: post #42

From a reddit comment: > The permissions you see on the install screen are actually triggered by various permissions in the permission group. I've checked Ubers (there's a button on the web play store and you can see it in the manifest), and the only one from the Device and App History group they actually use is "GET_TASKS", or get a list of recently opened apps. > Furthermore, on Lollipop this permission doesn't eve…

Either that's not entirely truthful, or the app permission system is totally broken... Need to find out when you last opened the app? "Get running apps"...?

I remember having to use GET_TASKS a couple of years ago (before Lollipop) on a well known app (tenths of millions of users).

IIRC, I needed to identify a couple of states :

- when the user is on the lockscreen.

- when the user is in another app.

- when the user is in our app.

- when the screen is off.

There were business reason behind this for a complex feature, nothing to do with the user's data.

The Android team does not want android devs to access to their own app UI state because 'the business logic should not have to depend on that' ...

Fair enough in theory but in practice there are a couple of times when you just need it.

For example even the Chromecast sample uses a ugly hack to access this piece of information (put a timer behind start/stop activity events).

I remember that a coworker had to revamp this piece of code recently for Marshmallow but I don't remember the details.

Google finally has a working permission model with Marshmallow : protect the private data behind popups, everything else is fair game.

It is not perfect by any means since users still tend to click yes on any popup ... but that's the best we can do IMO.

Re: Uber wants access to browsing history, bookmarks, and running apps

#212

Post by on_and_off »

dlubarov wrote: post #67
matt_wulfeck wrote: post #49

Earlier quoted context omitted.

Either that's not entirely truthful, or the app permission system is totally broken... Need to find out when you last opened the app? "Get running apps"...?

This page has more detail on Android's permissions model: http://developer.android.com/guide/topics/security/permissio... I don't really understand the point of having fine-grained permissions (like READ_CONTACTS), when the user only sees broader permission groups. Can someone shed light on this?

That's because the permission model is back compatible.

Instead of creating a new 'access contact permission', the permissions are now bundled automatically.

That way the same manifest (where you declare a bunch of things about your app, including its permissions) can be used for both old and new devices.

As far as the manifest is concerned, it would have been easy to automatically generate the old permission list from a new permission list like {Contacts, Calendars, ...} but you would also have to create a new library to translate these new permissions to the old ones in the code (since old OS versions still only understand the permissions that existed with them) ...

It is probably easier to just keep the old permissions.

Re: Uber wants access to browsing history, bookmarks, and running apps

#213

Post by Freak_NL »

ryan-allen wrote: post #172

I'm really starting to worry about this as an Android user. If I want to keep control of my privacy there are so many apps that I can't trust to install. Even little dinky games are asking for access to contacts and messages and all sorts of other things. An application on a desktop computer that steals data from your email application and sends it back to base is called "Malware". On Android, this is called "busines…

Not sure why you are getting downvoted for voicing a valid concern.

Re: Uber wants access to browsing history, bookmarks, and running apps

#214

Post by on_and_off »

jarnix wrote: post #71

This permission should just simply not exist. I had two games and an another app. The browsing history was, in this case, used for targetting ads. I did not need the apps and uninstalled the apps (it was around 2 years ago, on previous version of Android I think). The apps on Android should be sandboxed and not be given this kind of permissions, that's all.

Well, browsing history sounds very helpful in order to create another browser and that's pretty much it.

The unfortunate thing is that it is bundled in the same group as 'running apps'.

I guess it is because Android's PMs wanted to limit the number of permissions groups but it means that many apps have to request it simply because they need GET_TASKS for old devices.

Re: Uber wants access to browsing history, bookmarks, and running apps

#215

Post by on_and_off »

jonathankoren wrote: post #63
askyourmother wrote: post #3

Very unnecessary overreach on android permissions.. Will be interesting to see how many of the fans of uber here on hn will try to spin this. Just forwarded to some friends, they are uninstalling the rogue app as I type this!

Isn't permission overreach du rigueur on Android? Seriously, I thought that this was a preferred engineering pattern on Android due to platform weirdness or something.

depends what you mean with overreach.

First : sadly most users (and I really mean most) don't even glance at the permission screen.

It makes it hard for us Android devs to push back against the product teams when they want to add a crazy feature needing a ton of permissions (I still do though and the fact that it breaks auto updates at least is a good argument... ).

The weird part of the permission system is that we have to transition from a 'designed by & for engineers system where there were a tons of different permissions that no users ever read to a granular system where you only need to ask user's permission in order to access private data.

IMO the platform is definitely moving in the right direction (if only because it apes the other platforms approach).

Re: Uber wants access to browsing history, bookmarks, and running apps

#216

Post by on_and_off »

on_and_off wrote: post #209
slight wrote: post #192

Earlier quoted context omitted.

Not OP but I found Lollipop pretty laggy and that it didn't add much I wanted, most of Google's updates come via Play now anyway. So also no reason to upgrade to Marshmallow either.

The revamped permission model is enough to make the update worth it IMO and that's not something that can be done via an app update.

Also, ART (the new vm introduced in Lollipop) was still pretty rough in Lollipop.

IIRC it even has some memory leaks ...

It is MUCH better in Marshmallow, so it is definitely worth upgrading because that's another thing where you just need to update the system.

Re: Uber wants access to browsing history, bookmarks, and running apps

#217

Post by JupiterMoon »

blackoil wrote: post #116
JupiterMoon wrote: post #65

Earlier quoted context omitted.

Drivers.

Drivers have a different app, this is the consumer app.

They may well share code and or library dependencies which could be where the 'need' for the permissions comes from.

Re: Uber wants access to browsing history, bookmarks, and running apps

#219

Post by ryan-allen »

Freak_NL wrote: post #213
ryan-allen wrote: post #172

I'm really starting to worry about this as an Android user. If I want to keep control of my privacy there are so many apps that I can't trust to install. Even little dinky games are asking for access to contacts and messages and all sorts of other things. An application on a desktop computer that steals data from your email application and sends it back to base is called "Malware". On Android, this is called "busines…

Not sure why you are getting downvoted for voicing a valid concern.

Probably due to the lack of scientific rigor that I failed to produce in all of 3 seconds, or, just general BS of an online community. Or shills, who knows! Nobody said this was a community of rational beings.
Post reply on HN