Android: I don't need your permission • Hacker News Board

Re: Android: I don't need your permission

#41

Post by jbk » Tue, Dec 16, 2014, 9:55 PM UTC

I wish it was that easy in all cases.

For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service).

The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work.

But on the play store it's written "read phone status and identity" and that's really really scary for the users.

And even if we're 100% open source, so people can check the application, and even people recompile VLC, this is a complaint we receive a lot...

Re: Android: I don't need your permission

#42

Post by Fando » Tue, Dec 16, 2014, 10:00 PM UTC

Good article. As good as Google's permission system is, it lacks obvious features. Maybe I'm missing something, but I think that Android permission are overly general and not specific enough in a majority of apps.

Re: Android: I don't need your permission

#43

Post by avz » Tue, Dec 16, 2014, 10:01 PM UTC

john61 wrote: post #36

avz wrote: post #28

Earlier quoted context omitted.

Good point. Given sufficient paranoia this train of suspicion can be continued even deeper down the rabbit hole: you'd need to inspect the hardware designs and make sure the hardware you've got was actually produced according to the inspected designs. In technology as elsewhere, it seems life is ultimately based on trust in someone.

> In technology as elsewhere, it seems life is ultimately based on trust in someone. trust is a function of control. With free software it is distributed trust and control. With proprietary Sw it is centralized trust and control. Real life proved that centralized control is a bad idea, that is why we invented democracy and free software.

Trust is a function of the expected incentives of the trusted.

One way to manage their incentives is by exercising control, but there are other more friendly ways, too. For example, shared goals, community, reputation, financial rewards, reciprocity and ethics standards all provide weaker or stronger reasons to trust others.

Re: Android: I don't need your permission

#44

Post by micampe » Tue, Dec 16, 2014, 10:01 PM UTC

nly wrote: post #37

Someone1234 wrote: post #12

> If your app is closed-source then they have no way of verifying you're not downloading all their contacts to their servers. That's a common fallacy. Even if it is open source someone could still be doing that. In order to be secure you would have to: A) Download the source yourself B) Inspect the source C) Compile the source Just because you have the source doesn't mean what you get from the Play Store/Amazon App s…

In practice you can disassemble Java apps to pseudo source code anyway. I've done it several times to APKs to see what is going on under the covers. Deliberate obfuscation would be immediately suspicious.

You say obfuscation I say compression.

Re: Android: I don't need your permission

#45

Post by senko » Tue, Dec 16, 2014, 10:01 PM UTC

tormeh wrote: post #16

foo2312 wrote: post #14

Earlier quoted context omitted.

It may seem a bit silly to add this, but I think it is good to link the reference for those who may not have seen it before: Even compiling from source, one also has to trust the compiler... (see, e.g. the classic http://cm.bell-labs.com/who/ken/trust.html , pdf version at https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp... )

And then you have to trust the OS. And the machine... Unless you build you computer yourself from silicon, you're not going to get rid of trust.

Further reading: http://en.wikipedia.org/wiki/Trusted_computing_base

Re: Android: I don't need your permission

#46

Post by acdha » Tue, Dec 16, 2014, 10:15 PM UTC

nly wrote: post #37

Someone1234 wrote: post #12

> If your app is closed-source then they have no way of verifying you're not downloading all their contacts to their servers. That's a common fallacy. Even if it is open source someone could still be doing that. In order to be secure you would have to: A) Download the source yourself B) Inspect the source C) Compile the source Just because you have the source doesn't mean what you get from the Play Store/Amazon App s…

In practice you can disassemble Java apps to pseudo source code anyway. I've done it several times to APKs to see what is going on under the covers. Deliberate obfuscation would be immediately suspicious.

1. How closely would you have to look to notice something like a weak crypto setup or other “accidental” change less obvious than sending everything to “all-your-bytes.nsa.gov”?

2. How many people other than blackhats actually have the time to do this for every single automatic update?

Re: Android: I don't need your permission

#47

Post by brk » Tue, Dec 16, 2014, 10:17 PM UTC

avz wrote: post #35

I would be very happy if instead of preventing me from installing apps which require a given permission, Android would let me install them at my own risk in a sandbox which provides the app with dummy data and interactions (whether from a sensor, contacts db, camera etc). It would be even better if the framework explicitly supported running apps without the necessary permissions and simply threw some sort of Permissi…

This sounds like a great way for paranoid but uninformed users to break lots of apps, and then blame the developer/phone/carrier (in any random order).

We sometimes forget that really with smartphones the manufacturers are trying to produce something for the masses. This would also seem to include reducing the amount of security consciousness the user needs to have in order to have an "acceptable" experience with the device.

Re: Android: I don't need your permission

#48

Post by ww520 » Tue, Dec 16, 2014, 10:21 PM UTC

This is classic privilege elevation via a 3rd party privileged process. I thought Android's permission system carrying the security context from app to app through Intent. Guess the assumption is wrong.

In most OS, the security token/context of the initiating process is carried over to the target process when it's asked to do something on behalf of the initiating process via IPC so that the target process runs at the privilege level of the initiating process even if the target process has a higher privilege to start with.

Re: Android: I don't need your permission

#49

Post by pbhjpbhj » Tue, Dec 16, 2014, 10:24 PM UTC

lucas-be wrote: post #25

tjbiddle wrote: post #15

Earlier quoted context omitted.

However that's not the only use case for android.permission.INTERNET - you need it for anything that does networking on the internet, such as API calls to your web application.

So the entire computer world had run like this for decade. why are people complaining about that now? Because Apple is doing strict verification of your code behaviour? Yesterday adobe pdf viewer tell me that an update was available both on my mac and pc! So without asking my permission, this computer application (and many others) are querying the web...

>So without asking my permission //

You give your permission when you install it with auto-update enabled. I always disable auto-update.

Re: Android: I don't need your permission

#50

Post by aferreira » Tue, Dec 16, 2014, 10:25 PM UTC

jbk wrote: post #41

I wish it was that easy in all cases. For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service). The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work. But on the play store it's w…

Actually, I don't think you need it.

If you can request permission to read the list of activities and do so when your activity is paused, you can search for the phone application (or even similar ones, such as Skype) and pause your audio playback?

Just a thought.