Didn't Google threaten to pull CyanogenMod's ability to distribute Google Play for implementing the same thing a while back?
Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps
51–60 of 63 posts
Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps
#52Earlier quoted context omitted.
Here's a thought: permissions shouldn't be asked for until they are needed, and one that should be disabled with no option to override is to spam your entire addressbook.
Just by accessing the addressbook you already have the means to spam everyone, if you are a bad actor. To prevent that from happening you've got to deny access to the addressbook altogether, which isn't desireable if you don't want to kill the market for Voip/Chat on mobile phones. Apps like Whatsapp, or the Voip/Xmpp client I am working on for my company just need a way to determine who on your contactlist is availa…
For apps that are explicitly used to contact people, sure, accessing the addressbook is assumed. But there should not be an option in any app to "tell everyone in your addressbook about this app!", and apps that do this behind the users back (or worse, mine addressbooks for email addresses) should be outright banned. There's a reason I hand out individualized email aliases, even to friends: far too much risk that they will leak the address, intentional or otherwise, and I can disable the alias at a whim.
Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps
#53Earlier quoted context omitted.
On iOS, if an app crashes or doesn't function when permissions are denied, it won't get approved to be in the app store.
The app does not have to crash. It can gracefully exit. Which, in the end, has the same result - if the user does not grant the permission, the app will refuse to work.
I admittedly don't download much of the App Store's free crapware, but I've never once seen this happen. Do you have an examples of apps that refuse to run when you don't allow a unnecessary permission?
Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps
#54Didn't Google threaten to pull CyanogenMod's ability to distribute Google Play for implementing the same thing a while back?
Citation needed?
Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps
#55Earlier quoted context omitted.
It does error checking. Would you write a program that constantly checks the config file to see if something changed, or to see if the euid it is running as suddenly changes? Of course not, why would you? And why would an Android app constantly check to see if the permissions it has been granted are suddenly un-granted? More to the point: why would an app ask for permissions it didn't need in the first place? The mos…
"More to the point: why would an app ask for permissions it didn't need..." Ad networks. So wrap the calls to the ad network library in try/catch, and, in most cases, that takes care of the mostly gratuitous permissions.
Or the Ad network code should handle this gracefully?
Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps
#56Earlier quoted context omitted.
There are some valid use cases for this. "Read All Contacts" is often required to optionally invite your friends. "List running Apps" for crash-reports.
Why can't some permissions be prompt-based, instead of always giving access to apps? Say for contacts, if you want to invite friend you'll allow access to contacts just now.
This is what Mozilla does lately with new HTML5 capabilities in Firefox (e.g. desktop notifications, camera access, location access, local storage), and presumably is also how Firefox OS works. I agree, it's a nice way to do things.
Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps
#57Cue the piles of posted code snippets on StackOverflow and similar to uselessly error out on startup without the full set of requested permissions. Well-behaved apps won't ask for permissions they don't need anyway, and badly-behaved apps will simply refuse to run without all the permissions they (and their ad services) request. Without the ability to pretend to have the permission but not actually provide useful dat…
Well-behaved apps won't ask for permissions they don't need anyway
I would say that this is close to universally untrue -- apps generally ask for permissions that cover the superset of all possible edge conditions, even though only a subset of their users will ever actually need that.. If I'm someone who will never use the contacts feature, for instance, I would love to have the option -- on install -- of saying "Yeah, I understand you want that but no, you aren't getting it". This is a step in that direction.
Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps
#58Earlier quoted context omitted.
Android as a framework is designed in such a way that most of the times you wish to access a feature of the device requires a permission you should be using components that can enforce a security check with the PackageManager or can handle the SecurityExceptions generated from not having a permission. Poorly architect-ed apps will have an issue with this, but those apps already have problems.
No. The Android API has always given the guarantee (and it still does) that your application's permissions will always be there. They can't be revoked during runtime. If it's in the manifest, it's perfectly fine to assume that you have it. No piece of documentation or sample code has ever encouraged a pattern of "checking if your app has permission X or Y" because it's a total waste of time. Likewise, none of the bui…
I'm not suggesting that apps do this or even if it is a good idea to have this level of security checks in code. Rather, the Android framework encourages decentralized pieces of code that revolve accessing various capabilities of the API. The kind of paradigms in Android could be considered to be already a bit helpful in that they promote certain kinds of application architecture that may be more easily adapted to doing such security checks.
Ultimately it is a matter of time before something like this does make its way into the core features of Android. It is worth thinking about how Android is both deficient and helpful with its design philosophy regarding that eventuality.
Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps
#59Earlier quoted context omitted.
"More to the point: why would an app ask for permissions it didn't need..." Ad networks. So wrap the calls to the ad network library in try/catch, and, in most cases, that takes care of the mostly gratuitous permissions.
Or the Ad network code should handle this gracefully?
Not that I'm sympathetic to ad networks that data rape you to support some half-baked behavioral targeting, but one reason they don't now handle it gracefully is that SecuirtyException should in most cases be unhandled, because it would indicate some kind of defective installation. That's why this change has to be phased-in.
Re: Hidden “App Ops” Feature in Android 4.3 Lets You Disable Permissions From Apps
#60Earlier quoted context omitted.
Why can't some permissions be prompt-based, instead of always giving access to apps? Say for contacts, if you want to invite friend you'll allow access to contacts just now.
This is what Mozilla does lately with new HTML5 capabilities in Firefox (e.g. desktop notifications, camera access, location access, local storage), and presumably is also how Firefox OS works. I agree, it's a nice way to do things.
for that matter, it's also how Chrome/Chromium/Chrome OS work.