It's unfortunate that regulators have largely overlooked privacy in smartphone apps amidst all the other concerns they have over such platforms.
The regulators want your data. For your protection.
We can't check the app permissions on Google Play anymore
101–110 of 121 posts
Re: We can't check the app permissions on Google Play anymore
#102"Permission" system is broken to begin with. Every app should get all the permissions they want, but the user could choose what kind of data to actually provide, none, some, all or even fake.
see also: XPrivacyLua
Re: We can't check the app permissions on Google Play anymore
#103Earlier quoted context omitted.
Do you have a source on that [credit cards]? From a casual further inspection, there are videos on YouTube which demonstrate this: https://www.youtube.com/watch?v=K_6oMZb8UOI
Someone else can probably give the technical details but from my understanding, all but the most primitive NFC cards use a challenge/response system rather than just an ID. So there is no way to actually clone the secret stored internally as this is never transmitted. I'm willing to bet that video is just plain fake. Especially given it only has 2k views.
I'd put stock in the video, it's using https://github.com/devnied/EMV-NFC-Paycard-Enrollment which seems reasonably popular.
Re: We can't check the app permissions on Google Play anymore
#104This is one reason I switched to F-Droid a while ago. Among other things, F-Droid is very strict about reporting potential anti-features, which (ironically?) makes me much more comfortable installing apps from that app-manager.
F-droid has one big anti feature itself: it tries to trick you to download their store app when all you want is to get the APK. Gives me 2015 sourceforge vibes
The main page at https://f-droid.org/en/ pretty much seems to be about the app, so I don't feel particularly tricked.
Thank you for pointing out that you can get APKs direct from the site too. That could be useful sometime!
Re: We can't check the app permissions on Google Play anymore
#105Earlier quoted context omitted.
> Some users would never even install apps that asked for too many static permissions on the Play page. This, so much! Like 90% of the apps on Play ask for an insanely excessive amount of permissions. It was the #1 indicator for sorting out garbage apps. Example: Some time ago I needed a kitchen timer app (stock one had some issue). The great majority of them wanted permissions like contacts, access to my files, GPS…
Get F-Droid and stick to free software for utility apps. That filters out 99% of the crap out there.
Problem with free software is that very often good programs are orphaned by original authors (looking at andOTP), and that creates more forks with usually even shorter lifetime. It would be wonderful to have some sort of organization for essential applications that provide crucial applications, but only with very limited feature set and only required updates for new Android versions.
Re: We can't check the app permissions on Google Play anymore
#106Earlier quoted context omitted.
> For some permissions, but not all of them. For example, they don't for Internet access. Then why does this "Permission" exist? When will it ever be false?
Because if an APK doesn't declare that permission, then it still can't access the Internet.
Why would an APK want to access the internet ? (why my Phone app needs internet access ?)
Re: We can't check the app permissions on Google Play anymore
#107Re: We can't check the app permissions on Google Play anymore
#108Earlier quoted context omitted.
> For some permissions, but not all of them. For example, they don't for Internet access. Then why does this "Permission" exist? When will it ever be false?
Because if an APK doesn't declare that permission, then it still can't access the Internet.
But why make it a "permission" then, if it is automatically granted? It should just be part of the regular API.
Re: We can't check the app permissions on Google Play anymore
#109What I always found very confusing is that apps on Android can either read all of the SD drive or nothing. Wouldn't the normal approach to gate applications from each other be to give each one the right to access a single directory? The way it is, all apps want to "READ_EXTERNAL_STORAGE" so they all can read all the data I save.
This is being clamped down on, at least for apps on the Play Store. How it works now is the app has unfettered access to its own internal and external storage directory, and can prompt the user to select another one to give access for saving additional data. There are some rough edges for implementors, though; for example, getting your content to show up in media player apps requires usage of a completely separate AP…
The basic idea is okay, but the practical implementation is terrible. There's additional overhead which slows down operations that need to touch lots of files, they've broken access via the standard file APIs while at the same time other Android APIs still only support standard files, the much touted media store mainly only caters for standard media file formats (i.e. images/audio/video), plus some standard "document" file formats, but good luck if your file type is too exotic (at least on my – admittedly somewhat older, though – phone even .EPUB files are already too exotic to be indexed by the media store), they've broken simple file sharing between multiple apps and effectively encourage apps to create their own private copy of such files, which is bonkers and for larger files unnecessarily takes up time and storage space, they've especially broken sharing multi-file file formats between apps (especially including the case of using a file manager app to browse through your storage and then directly open such a file in another app), …
I suppose the most common "regular user" scenarios sort of mostly work (except possibly for some performance overhead in some cases), but for more "power user"-like usage scenarios it's all too easy too run into all sorts of edge cases, limitations, and bugs that break your workflows.
Re: We can't check the app permissions on Google Play anymore
#110Earlier quoted context omitted.
The permissions list on the play store was completely useless from a privacy standpoint. Even power users could to just about nothing with the info. The situation now where you approve or reject permissions as they are used in the app is vastly better than the original android model of being shown a wall of text with the options to either give away all of your data and security or not install the app.
I remember the situation where Google used to bundle permissions in illogical ways. it's been too long to remember specifics but it essentially meant an app had to request the ability to access unnecessary things and required the dev to explain in the release notes as to why.
One example I remember is that music players used to require reading the phone status in order to be able to pause playback during a call. I think these days you can mostly get by using the audio focus APIs instead, but historically that wasn't the case.