Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android: I don't need your permission

blog.danlew.net

Post reply on HN
Print view View original

51–60 of 190 posts

Re: Android: I don't need your permission

#51

Post by masklinn »

jbk wrote: post #41

I wish it was that easy in all cases. For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service). The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work. But on the play store it's w…

> For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call.

It's seriously back-asswards that you'd have to have access to all phone state just to be able to start and stop audio on phone calls.

By comparison iOS has an audio interruption system which gets triggered on phone calls, alarms (calendar and clock) and other applications taking over the audio, the application getting interrupted neither not knows nor cares where the interruption comes from, only that it doesn't have the audio stream anymore.

Re: Android: I don't need your permission

#52

Post by eslaught »

brk wrote: post #47
avz wrote: post #35

I would be very happy if instead of preventing me from installing apps which require a given permission, Android would let me install them at my own risk in a sandbox which provides the app with dummy data and interactions (whether from a sensor, contacts db, camera etc). It would be even better if the framework explicitly supported running apps without the necessary permissions and simply threw some sort of Permissi…

This sounds like a great way for paranoid but uninformed users to break lots of apps, and then blame the developer/phone/carrier (in any random order). We sometimes forget that really with smartphones the manufacturers are trying to produce something for the masses. This would also seem to include reducing the amount of security consciousness the user needs to have in order to have an "acceptable" experience with the…

And yet, the iPhone basically does this for a number of permissions (location, push notifications, contacts access, etc.), and for the most part it seems to work for even uneducated users of iOS.

For most permissions, you might not want this, but for some of the more sensitive and personal-information rich sources, this is a really highly desirable feature.

Re: Android: I don't need your permission

#53

Post by masklinn »

aferreira wrote: post #50
jbk wrote: post #41

I wish it was that easy in all cases. For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service). The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work. But on the play store it's w…

Actually, I don't think you need it. If you can request permission to read the list of activities and do so when your activity is paused, you can search for the phone application (or even similar ones, such as Skype) and pause your audio playback? Just a thought.

That the phone application is launched does not mean the user is currently in a call, they could be browsing their contacts list.

Re: Android: I don't need your permission

#54

Post by voltagex_ »

Ded7xSEoPKYNsDd wrote: post #34
joshfraser wrote: post #26

Earlier quoted context omitted.

I assume you'd set up a custom CA on your proxy so you can spy on the https traffic. I'd be suspicious if I saw large blogs of data that had been encrypted in the application instead of at the network layer.

But then best practices say you should be doing cert pinning. That will block your CA. Although for most apps modifying that check to look for another cert is probably not too hard. (But of course if the app is obfuscated and does integrity checks on itself, it can get arbitrarily complicated.)

I visit sites with cert pinning at $EMPLOYER. $EMPLOYER runs a very expensive solution from Blue Coat which includes a MITM CA - no issues intercepting anything here. Amusingly, this meant the proxy itself was vulnerable to Heartblead while the client machines were not.

Re: Android: I don't need your permission

#55

Post by marvy »

micampe wrote: post #44
nly wrote: post #37

Earlier quoted context omitted.

In practice you can disassemble Java apps to pseudo source code anyway. I've done it several times to APKs to see what is going on under the covers. Deliberate obfuscation would be immediately suspicious.

You say obfuscation I say compression.

good one!

Re: Android: I don't need your permission

#56

Post by quantumet »

masklinn wrote: post #51
jbk wrote: post #41

I wish it was that easy in all cases. For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service). The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work. But on the play store it's w…

> For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. It's seriously back-asswards that you'd have to have access to all phone state just to be able to start and stop audio on phone calls. By comparison iOS has an audio interruption system which gets triggered on phone calls, alarms (calendar and clock)…

So does Android:

http://developer.android.com/training/managing-audio/audio-f...

http://android-developers.blogspot.com/2013/08/respecting-au...

Re: Android: I don't need your permission

#57

Post by marvy »

foo2312 wrote: post #14
Someone1234 wrote: post #12

> If your app is closed-source then they have no way of verifying you're not downloading all their contacts to their servers. That's a common fallacy. Even if it is open source someone could still be doing that. In order to be secure you would have to: A) Download the source yourself B) Inspect the source C) Compile the source Just because you have the source doesn't mean what you get from the Play Store/Amazon App s…

It may seem a bit silly to add this, but I think it is good to link the reference for those who may not have seen it before: Even compiling from source, one also has to trust the compiler... (see, e.g. the classic http://cm.bell-labs.com/who/ken/trust.html , pdf version at https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp... )

There is a simple antidote to this problem, as long as you have 1) the source code to the compiler you suspect of being bad, and 2) a second compiler (binary only), written by someone who is not friends with the first one. For instance, if you want to verify that gcc is not evil, you need the gcc source, and MS Visual C++. The basic idea is summarized by Bruce Schnier here: https://www.schneier.com/blog/archives/2006/01/countering_tr...

Re: Android: I don't need your permission

#58

Post by jonalmeida »

In the example about the phone call, you could give the user the option to hit the call button, but once this is complete a dialog should popup saying, "Do you want this to happen automagically henceforth?" which would then take full use of the Phone permission. This would also allow permissions to be toggled on/off, which a feature I really want in Android.

Re: Android: I don't need your permission

#59

Post by piyush_soni »

jbk wrote: post #41

I wish it was that easy in all cases. For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service). The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work. But on the play store it's w…

I think if all such problems are reported to Google (bugs filed), they might fix these in the next versions of the APIs (i.e., making permissions more fine-grained and less inclusive)

Re: Android: I don't need your permission

#60

Post by Nursie »

jbk wrote: post #41

I wish it was that easy in all cases. For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service). The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work. But on the play store it's w…

It is totally nuts. Whoever thought to bundle all of that stuff up in one huge permission...
Post reply on HN