Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android: I don't need your permission

blog.danlew.net

Post reply on HN
Print view View original

161–170 of 190 posts

Re: Android: I don't need your permission

#161

Post by Aldo_MX »

habosa wrote: post #109
Aldo_MX wrote: post #90

Earlier quoted context omitted.

1) Incremental Authorization - let Android apps ask for permissions only as they need them. So if you never use the phone dialing feature, they never ask for the permission. Not only incremental authorization, but the ability of denying specific permissions.

Well with incremental the developer would put what is 'required' into the manifest for install-time prompt and incremental the rest. You can't expect a developer to allow you to deny any permission, the whole app would be a giant if-statement spaghetti accounting for all of the permission combinations and workarounds.

As a user, I don't care if your app will self-destruct if you don't get access to permissions like "read and send SMSs". I simply don't want a free to play game to scan my SMSs for advertisement purposes.

Re: Android: I don't need your permission

#162

Post by marcosdumay »

MichaelGG wrote: post #157
rplnt wrote: post #125

Earlier quoted context omitted.

It should need a permission in my opinion. Why should a calculator (for example) know if there is incoming call? But this case should be handled by a permission in dialer (or whatever handles incoming calls) - something like "allow to broadcast mute to all other applications".

Why shouldn't it? It's on a phone; it's part of basic usability. And the cure in Google's case is far, far worse. Give them access to your IMEI and phone numbers in and out. I know assume incompetence over maliciousness, but this stretches belief. Especially combined with the rest of Google's little tricks.

> I know assume incompetence over maliciousness, but this stretches belief.

It's worse than that. Android had a saner permission interface, with a separated permission just for detecting if the phone is ringing. Google "updated" it to the current format alledging the previous one was too confusing.

Re: Android: I don't need your permission

#163

Post by dec0dedab0de »

tripzilch wrote: post #146
robert_tweed wrote: post #118

> Case in point: android.permission.CALL_PHONE. You need it to initiate phone calls from your app, right? This kind of thing is why I can't see myself switching to Android as my primary mobile OS any time soon. If anything, I can see a bright future for Microsoft. In spite of the fact Windows Phone exists, Android is very much the Windows of the mobile ecosystem. Permissions on Android are horrendous for developers.…

I' an Android (Cyanogenmod) user and agree with your point, this could--and should--be done a lot better. I am not familiar with iOS and iPhones at all. You state iOS apps only rarely need to be granted permissions, how do they make that work? I can see only three ways that could happen: Either the app can do most things without asking permissions (bad for the user--there'd be malware). Or the app simply can't ask fo…

Linux software from the repositories doesn't need to ask for permission for anything (except sudo). Still, there is no malware in the repositories, at all. I admit I am a little bit vague on how this works too, perhaps I'm missing something obvious, but how do they do that?

You are simply trusting whoever is running the repository, most of the time this the distro itself, which you already trust.

Re: Android: I don't need your permission

#164

Post by drzaiusapelord »

robert_tweed wrote: post #118

> Case in point: android.permission.CALL_PHONE. You need it to initiate phone calls from your app, right? This kind of thing is why I can't see myself switching to Android as my primary mobile OS any time soon. If anything, I can see a bright future for Microsoft. In spite of the fact Windows Phone exists, Android is very much the Windows of the mobile ecosystem. Permissions on Android are horrendous for developers.…

>And when every app requests at least half a dozen permissions

I think this is the core problem here. The "list of permissions" system doesn't make sense to anyone and just seems like some project manager following a list of checkboxes from a list of security practices.

I recently stopped using my Nexus 10 due to getting an iPad3 for a steal. I love being asked if an application can use my location, as opposed to having god knows how many apps on my N10 silently sampling my position. I love knowing that the entire OS isn't dedicated to better selling ads for app publishers. Apple, for all its faults, isn't in bed with the ad industry like Google is.

I really was hoping features like this would come to Lollipop, but apparantly this isn't a priority for Google. Instead we get a byzantine line of permissions no one understands and we all say "Yes" because we want the app. There's no alternative. If the Amazon Kindle app has a permission I must accept it to read my books. I can't just say "No" to location awareness or contact list reading.

Re: Android: I don't need your permission

#165

Post by snake_plissken »

I recently got a Moto E as my first smart phone, ever, and after checking out some apps, I was astounded and befuddled by the access permissions that it seems every app needs.

Take ESPN's fantasy football app, which requires: device and app history - whats apps are running, browsing history, bookmarks identity - accounts on the device, profile data photo/media/files - access to files on the device and the device's external storage wi-fi connection information - whether wi-fi is enabled, names of connected wi-fi devices device ID and call information - determine the phone number and device IDs, whether a call is active, and the remote number connected by a call

I can understand why it might need access to the file system to, for example, upload an avatar. The access to wi-fi seems innocuous, although I would expect something like network connectivity and status to be delegated to a kernel module or background daemon with which an app interfaces.

But is there any legitimate (i.e. some non-financial oriented mine as much data as possible) reason it needs to be able to see what other apps are running, my browser history or who is on the other end of a call? There might not be any reason, and ESPN could potentially build the app to have as many or as few permissions as they deem valuable, because people want an app to manage fantasy football teams first. While this example might not be the best, since ESPN is a huge brand and there is no alternative if they are hosting your league, the situation was the same with so many other apps; just absurd permission requirements.

None were installed.

Re: Android: I don't need your permission

#166

Post by 9point6 »

wtbob wrote: post #134
hrjet wrote: post #106

Earlier quoted context omitted.

Adding to that: In Android Lollipop, One can't edit / delete local (phone-stored) contacts. They have to be synced to cloud in order to edit / delete them. If this is intentional, it is a sick dark UI pattern.

It wouldn't matter if contacts were encrypted client-side, but Google seen to have a severe allergy to client-side encryption. Mozilla are really leading the way on this issue. What I think is particularly sad is that Google could still make a huge amount of money without exposing one's private information directly.

Don't all the current nexus devices come with full-device encryption enabled?

Re: Android: I don't need your permission

#167

Post by krschultz »

tripzilch wrote: post #147
ygra wrote: post #137

Earlier quoted context omitted.

Which doesn't really help the users stuck on Android versions that never get any update or bugfixes. In which case apps have to take the pragmatic route and just work around the issue. Even if that requires a scary permission. No user would point to Google and say »VLC doesn't pause when the phone rings, fix the ringer, please.«. Rather they point to VLC and say »VLC doesn't pause when the phone rings, fix VLC please…

Would be nice if you could request "you're using an older version of Android so we need more scary permissions".

You can.

Split your APK based on SDK version. Have different manifests with different permissions & code for the respective versions. The new Gradle toolchain makes all of that easy to do, but it is tough to maintain lots of version specific code long term.

Re: Android: I don't need your permission

#168

Post by [deleted] »

Aldo_MX wrote: post #161
habosa wrote: post #109

Earlier quoted context omitted.

Well with incremental the developer would put what is 'required' into the manifest for install-time prompt and incremental the rest. You can't expect a developer to allow you to deny any permission, the whole app would be a giant if-statement spaghetti accounting for all of the permission combinations and workarounds.

As a user, I don't care if your app will self-destruct if you don't get access to permissions like "read and send SMSs". I simply don't want a free to play game to scan my SMSs for advertisement purposes.

[deleted]

Re: Android: I don't need your permission

#170

Post by tripzilch »

dec0dedab0de wrote: post #163
tripzilch wrote: post #146

Earlier quoted context omitted.

I' an Android (Cyanogenmod) user and agree with your point, this could--and should--be done a lot better. I am not familiar with iOS and iPhones at all. You state iOS apps only rarely need to be granted permissions, how do they make that work? I can see only three ways that could happen: Either the app can do most things without asking permissions (bad for the user--there'd be malware). Or the app simply can't ask fo…

Linux software from the repositories doesn't need to ask for permission for anything (except sudo). Still, there is no malware in the repositories, at all. I admit I am a little bit vague on how this works too, perhaps I'm missing something obvious, but how do they do that? You are simply trusting whoever is running the repository, most of the time this the distro itself, which you already trust.

I figured as much. Is it hard to get your software into, say, the Debian repos? (and thereby Ubuntu, etc.)
Post reply on HN