Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android: I don't need your permission

blog.danlew.net

Post reply on HN
Print view View original

81–90 of 190 posts

Re: Android: I don't need your permission

#81

Post by learnstats2 »

aferreira wrote: post #50
jbk wrote: post #41

I wish it was that easy in all cases. For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service). The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work. But on the play store it's w…

Actually, I don't think you need it. If you can request permission to read the list of activities and do so when your activity is paused, you can search for the phone application (or even similar ones, such as Skype) and pause your audio playback? Just a thought.

"Check out everything I do with my phone" is one of the permissions I would be more concerned about giving up.

Re: Android: I don't need your permission

#82

Post by stevebot »

Just curious though for these specific examples as it says "if you read the source", could these intent's change in future releases, or is it documented outside of the source and accepted that using these intents is not relying on Android internals that could change?

Re: Android: I don't need your permission

#83

Post by habosa »

There are two additions to the permissions API that I think would be very helpful:

1) Incremental Authorization - let Android apps ask for permissions only as they need them. So if you never use the phone dialing feature, they never ask for the permission. 2) One-time auth - allow an Android app to do something once. Say, scan your contacts one time. This gives you a little more control, so you know the dev isn't monitoring your phone at 3am.

Here is the problem though: most people don't actually care. The vocal minority cares, but most Android users don't know what a permission is if you ask them. So all that developers get for trying to work around permissions is less people using their app or less features in the app. Sadly there is no real incentive for a developer to be sparing with permissions for apps that target the mass market.

Re: Android: I don't need your permission

#84

Post by masklinn »

r00fus wrote: post #77
Nursie wrote: post #60

Earlier quoted context omitted.

It is totally nuts. Whoever thought to bundle all of that stuff up in one huge permission...

The same people that would prefer if you give all permissions. I still see no reason why Google doesn't implement more granular permissions models. Has the latest Android given you the ability to restrict an apps permissions after install without resorting to trusting 3rd party tools like xPrivacy or uninstalling the app?

> The same people that would prefer if you give all permissions. I still see no reason why Google doesn't implement more granular permissions models.

In fact they have gone the other way with "permission groups"

> Has the latest Android given you the ability to restrict an apps permissions after install without resorting to trusting 3rd party tools like xPrivacy or uninstalling the app?

The hidden "AppOps" (post-install management of permissions) appeared in 4.3 but was removed in 4.4.2, so no.

Re: Android: I don't need your permission

#85

Post by M2Ys4U »

mrpdaemon wrote: post #18
Someone1234 wrote: post #12

> If your app is closed-source then they have no way of verifying you're not downloading all their contacts to their servers. That's a common fallacy. Even if it is open source someone could still be doing that. In order to be secure you would have to: A) Download the source yourself B) Inspect the source C) Compile the source Just because you have the source doesn't mean what you get from the Play Store/Amazon App s…

The chain of trust doesn't quite stop at compiling the source, in order to be really sure that nothing unintended is going on you have to compile the compiler yourself. At the end of the day you will have to trust some bootstrapping binary compiler unless you put it together yourself in machine language.

Actually, you don't.

You can use two different compilers that compile each other to prove that the compilation won't be tampered with.

See https://www.schneier.com/blog/archives/2006/01/countering_tr...

Re: Android: I don't need your permission

#86

Post by aferreira »

jbk wrote: post #66
aferreira wrote: post #50

Earlier quoted context omitted.

Actually, I don't think you need it. If you can request permission to read the list of activities and do so when your activity is paused, you can search for the phone application (or even similar ones, such as Skype) and pause your audio playback? Just a thought.

But, we're not an activity! That's the issue! We're a background service to play audio. And adding a new permission is the opposite of what we want.

You don't have to be an activity at all, your service can do that. But the comment where someone might just be browsing their contact list makes sense too.

Re: Android: I don't need your permission

#87

Post by mike_hearn »

r00fus wrote: post #77
Nursie wrote: post #60

Earlier quoted context omitted.

It is totally nuts. Whoever thought to bundle all of that stuff up in one huge permission...

The same people that would prefer if you give all permissions. I still see no reason why Google doesn't implement more granular permissions models. Has the latest Android given you the ability to restrict an apps permissions after install without resorting to trusting 3rd party tools like xPrivacy or uninstalling the app?

The existing permissions are already so fine grained it's insane. Almost every API has its own permission, regardless of whether that would be understandable to normal users or not.

The Android security model does a great job of security. It was not designed to be a general purpose privacy guard that lets you engage in some complicated multi-way negotiation with every app you install over every aspect of your personal data. Such a system might be a feature of future operating systems, but currently I'm unaware of any such OS.

Re: Android: I don't need your permission

#88

Post by shadowmint »

dozy wrote: post #13
CSDude wrote: post #10

This is the another reason I use CyanogenMod. It has Privacy Guard and I can disable the nasty permissions as I please. If you have Android 4.3+, you can also install it indivudally https://play.google.com/store/apps/details?id=com.findsdk.ap... (requires root I guess) The most helpful one, even if you are not privacy/security concerned is to disable wake up/keep awake requests, which Facebook and FB Messenger used i…

I love CyanogenMod (or at least the concept...I'm over dealing with the headache in practice), but the reason I used it was certainly not for improved stability and security. Not that I particularly trust OEMs/carriers, but the only way I'd feel more secure with CyanogenMod is if I had time to audit the source and build the kernel and OS binaries myself, and that includes whatever code is used to root and unlock your…

This reminds me of the recent fireside android chat at I/O where someone said something like "I need to be prepared for although I got the permission, it might not be there".

...and they said "We work on the Play Store, and uh... that's not something we have any idea about"

"No, I think he's talking about the ROM's that let you take a permission away. Wanna talk about AppOps?"

Everyone looks awkward. 'No'. Ok... let's quickly talk about something else instead.

(watch it here. Fun times. http://youtu.be/K3meJyiYWFw?t=17m27s)

Re: Android: I don't need your permission

#89

Post by tn13 »

I think all apps should be given a choice to have ephimeral permission. For example I dont want someone to find an exploit in my app and steal my user's contacts.

I would only take contacts permission when I need and keep it for a short duration and then willingly give it up. User can be explicitly prompted.

Also, Camera and Microphones should have only this sort of permissions other than for those which are explictily whitelisted by Google.

Re: Android: I don't need your permission

#90

Post by Aldo_MX »

habosa wrote: post #83

There are two additions to the permissions API that I think would be very helpful: 1) Incremental Authorization - let Android apps ask for permissions only as they need them. So if you never use the phone dialing feature, they never ask for the permission. 2) One-time auth - allow an Android app to do something once. Say, scan your contacts one time. This gives you a little more control, so you know the dev isn't mon…

1) Incremental Authorization - let Android apps ask for permissions only as they need them. So if you never use the phone dialing feature, they never ask for the permission.

Not only incremental authorization, but the ability of denying specific permissions.

Post reply on HN