Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

droid-life.com

Post reply on HN
Print view View original

41–50 of 63 posts

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#41

Post by dman »

archivator wrote: post #39
dman wrote: post #33

Earlier quoted context omitted.

It shouldnt be on the carrier / manufacturer. Whats innately different about the software on phones as compared on Windows / OSX / linux ... that the user cant be trusted with administrative rights on their machine?

Uhm, yes, that, precisely. Most of Android is on a level playing field - core framework services get elevated permissions under the system group but they're still apps . If you let the user uninstall them, all hell will break loose. It's like removing the svchost.exe process in Windows. Or removing /bin/sh in Linux. The rest just doesn't work without it. Things like Contacts, Calendar storage, Bluetooth, Play Store,…

Learning the nexus lesson slowly.

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#42

Post by FigBug »

pat2man wrote: post #29
JoshTriplett wrote: post #18

Cue the piles of posted code snippets on StackOverflow and similar to uselessly error out on startup without the full set of requested permissions. Well-behaved apps won't ask for permissions they don't need anyway, and badly-behaved apps will simply refuse to run without all the permissions they (and their ad services) request. Without the ability to pretend to have the permission but not actually provide useful dat…

> badly-behaved apps will simply refuse to run without all the permissions they (and their ad services) request If this were true it would be an issue on iOS. Its not.

On iOS, if an app crashes or doesn't function when permissions are denied, it won't get approved to be in the app store.

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#43

Post by SEMW »

derleth wrote: post #22
eigenvector wrote: post #15

Earlier quoted context omitted.

That's exactly what Privacy Guard in CM does. https://plus.google.com/+CyanogenMod/posts/86LLXrDpVWY

Too bad CyanogenMod itself phones home to tell the developers about you.

Of all the privacy intrusions you're subjected to, are you seriously making an issue out of optional, transparent, anonymized hardware reports, in a Free Software project, used to compile publicly available statistics[1] on what phones people use the software so the devs can better direct development effort? Really?

[1] http://stats.cyanogenmod.org

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#44

Post by girvo »

cmircea wrote: post #37
bnr wrote: post #34

Earlier quoted context omitted.

There are some valid use cases for this. "Read All Contacts" is often required to optionally invite your friends. "List running Apps" for crash-reports.

Why can't some permissions be prompt-based, instead of always giving access to apps? Say for contacts, if you want to invite friend you'll allow access to contacts just now.

This is how iOS does it, and I agree, Android should copy this feature.

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#45

Post by aray »

keltex wrote: post #9

It would be nice if there was also a "simulate" option for some permissions. That way the app would think it has a permission when it doesn't. It could return an empty phonebook for contacts or random location for GPS or confirm a SMS was sent when it never went out, etc.

This was a research project at my university a while ago: http://news.ncsu.edu/releases/wms-jiang-tissa/

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#46

Post by rogerbinns »

mynewwork wrote: post #11

Fantastic. I barely have any apps on my phone because I refuse to accept the egregious abuse of privacy (why does Pandora or Yelp need to access my contacts etc). Recently some friends recommended WhatsApp, but after seeing the massive wall of permissions it was requesting, I didn't install. I've been waiting for this feature since the day I got my first android phone.

What I really hate is that you can pay for and install an app with an acceptable set of permissions, and then later the developer can add new unacceptable permissions essentially changing the product you bought. You can try to defer installation of the new version for a while, but it gets increasingly difficult.

I am of the opinion you should be offered a refund/uninstall if new permissions get added. Or have a way of disabling them like the posting is about.

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#47

Post by JoshTriplett »

npsimons wrote: post #35
JoshTriplett wrote: post #18

Cue the piles of posted code snippets on StackOverflow and similar to uselessly error out on startup without the full set of requested permissions. Well-behaved apps won't ask for permissions they don't need anyway, and badly-behaved apps will simply refuse to run without all the permissions they (and their ad services) request. Without the ability to pretend to have the permission but not actually provide useful dat…

and badly-behaved apps will simply refuse to run without all the permissions they (and their ad services) request. With any luck, those apps will (rightfully) die do to lack of user base. Of course, the cynic in me knows that the unwashed masses will never go to the trouble of dealing with all those permissions, even if they know about them. BTW, what do you consider "badly-behaved"? I've seen so many "good" apps ask…

> BTW, what do you consider "badly-behaved"? I've seen so many "good" apps ask for so much it boggles my mind (as someone else mentioned, WTF does a music player need access to your addressbook?).

Any app which requests a permission whose use isn't instantly obvious from the nature of the app. "Full network access" for a non-multiplayer game. "Location access" for anything that isn't a mapping app or point-of-interest finder (and even the latter ought to allow manual zipcode entry or similar). Contact access for any non-communications app. Phone state access for almost any app that isn't an dialer or call-control management app.

A music player that asks for access to your contacts would fall squarely under "badly behaved".

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#48

Post by DominikR »

npsimons wrote: post #36
bnr wrote: post #34

Earlier quoted context omitted.

There are some valid use cases for this. "Read All Contacts" is often required to optionally invite your friends. "List running Apps" for crash-reports.

Here's a thought: permissions shouldn't be asked for until they are needed, and one that should be disabled with no option to override is to spam your entire addressbook.

Just by accessing the addressbook you already have the means to spam everyone, if you are a bad actor.

To prevent that from happening you've got to deny access to the addressbook altogether, which isn't desireable if you don't want to kill the market for Voip/Chat on mobile phones.

Apps like Whatsapp, or the Voip/Xmpp client I am working on for my company just need a way to determine who on your contactlist is available for chat/Voip via your app.

Also: how do you think that apps like Skype enable you to call some landline number for a cheaper rate? They do this by creating a local dialin number that routes the caller to the actual destination.

What could work is that the OS gives hashes instead of the real numbers to the apps, but that would suck for anyone that had a web service that needs those numbers. (for say creating a cheaper dialin number to call some of your contacts)

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#49

Post by vetinari »

FigBug wrote: post #42
pat2man wrote: post #29

Earlier quoted context omitted.

> badly-behaved apps will simply refuse to run without all the permissions they (and their ad services) request If this were true it would be an issue on iOS. Its not.

On iOS, if an app crashes or doesn't function when permissions are denied, it won't get approved to be in the app store.

The app does not have to crash. It can gracefully exit.

Which, in the end, has the same result - if the user does not grant the permission, the app will refuse to work.

Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps

#50

Post by StavrosK »

JoshTriplett wrote: post #18

Cue the piles of posted code snippets on StackOverflow and similar to uselessly error out on startup without the full set of requested permissions. Well-behaved apps won't ask for permissions they don't need anyway, and badly-behaved apps will simply refuse to run without all the permissions they (and their ad services) request. Without the ability to pretend to have the permission but not actually provide useful dat…

This will very likely simulate full permissions, or it would be useless.
Post reply on HN