Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

eff.org

Post reply on HN
Print view View original

121–130 of 207 posts

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#121

Post by reginaldjcooper »

corresation wrote: post #77
jackgavigan wrote: post #18

This is one area where iOS stands head and shoulders above Android. I used to run Cyanogenmod and I remember deciding to not upgrade the Facebook app because doing so would have required giving it a slew of permissions, including the ability to "directly call phone numbers". By contrast, in iOS, I can choose which apps have access to my location, contacts, etc. I know that Apple's track record when it comes to privac…

By contrast, in iOS, I can choose which apps have access to my location, contacts, etc. Could you detail the "etc"? To my knowledge historically the only activity that triggered a permission confirmation was a precise location fix. Later, after a debacle with many apps siphoning and scurrilously offloading contact lists, contact access was added as a confirmation. Android has very granular permissions, and iOS does n…

Android's permissions are not granular enough and forcing the user to accept them all or not use the app is a security/privacy fail. I love that Android apps can access the telephony API but the permissions for that need to be more fine grained and the toggles to enable them need to be discreet over individual permissions.

Discreet toggles and the request dialogs are roughly the only thing I prefer iOS to Android on. Too bad the rest of iOS is a prison.

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#122

Post by jxf »

exodust wrote: post #117
jxf wrote: post #92

Earlier quoted context omitted.

That's partially because developers are somewhat incentivized to "front-load" their permissions. If you think there's even a chance you might use a permission, even if your app doesn't currently use it, ask for it on the first install. Then, later, when you actually do want to use it, your app update won't say that you need any new permissions.

This doesn't sound right to me. I don't think developers are doing this.

I don't think developers should do it, but there's no question that they're doing it.

For example, Facebook requests almost every permission under the sun. But if you look at the average user's permission profile for their Facebook app, they'll only show a tiny fraction of the overall permissions that Facebook originally requested.

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#123

Post by tomrod »

pjc50 wrote: post #113
CalRobert wrote: post #24

I'm probably going to turn in to that old guy with tin foil who can't play any games because nobody supports his choice of platform, but I really miss when computers were devices you could buy and then put your choice of OS on. Phones are pretty much just little ARM computers, why the hell don't I just install Ubuntu, Firefox OS, Android, WinPhone, Symbian, whatever? I could format a microSD card to boot from and go…

The touch keyboard lacks feedback but folds to zero size, which is its great advantage. And people are in practice getting along just fine with them, which is why the hardware keyboards have fallen by the wayside. The main obstacle to boot-your-own-phone in the US is of course the carriers.

> The main obstacle to boot-your-own-phone in the US is of course the carriers.

Surely if it were profitably one of them would break ranks, right? I mean, we have intelligent businesspeople in telecoms at least occasionally?

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#124

Post by stanleydrew »

FigBug wrote: post #96
mdorazio wrote: post #84

Earlier quoted context omitted.

Looking at the Settings area on my phone, it is possible in iOS 6 to set App-level permissions for: -Push Notifications -Location Services -Contacts -Calendars -Reminders -Photos -Bluetooth -Twitter Account Access -Facebook Account Access. Note that iOS7 may have added more.

My only complaint is iOS apps know if the permission is denied, so every time you switch to them they can ask you to enable permissions which is annoying (Facebook messenger). I wish they just returned no data.

That might work for contacts, but what does it mean to "return no data" for location services or bluetooth? In those cases isn't "no data" indistinguishable from "disallowed permission"?

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#125

Post by reginaldjcooper »

DanBC wrote: post #34
ansible wrote: post #19

The original intention (as explained by Dianne Hackborn among others) is that if the user sees the app requesting too many capabilities... the user should simply choose not to install the app. Having the user needing to understand all the different capabilities is too much. Having a bunch of pop-ups ( cough Vista) is also bad UI design. The current set of capabilities is too technical for end users to really understa…

> Have a single fake IMEI number, for example. How would that work in countries where modifying the IMEI is illegal? UK law (note prison sentence) http://www.legislation.gov.uk/ukpga/2002/31/section/1 I don't know if this is current US law or not. Here's one example http://thomas.loc.gov/cgi-bin/query/z?c112:S.3186.IS :

That is one of the more shortsighted laws I have ever read. Or farsighted, depending on your cynicism about surveillance.

I wonder if I generate a UUID on your phone in my app, if you delete the app data does that run afoul of this law?

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#126

Post by tomrod »

davedx wrote: post #3

I think it's a great feature. There have definitely been some apps where I would have liked to use them but they've had permissions requirements that I did not believe the app's core functionality needed.

For me, it's things like Facebook, Dropbox, Google search, Twitter, Skype, and a plethora of others that one would expect to seamlessly allow for permissions adjustments.

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#127

Post by kllrnohj »

cognivore wrote: post #97

There is another point here, one I think even more important and more disconcerting. Google released an entire feature of their Android OS BY ACCIDENT. W...T...F?! How do you release a feature "by accident?" By having awful quality control? How does that make me feel about the rest of their Android OS now? Either this, or they're lying through their teeth in an effort to cover up. In either case, it's evil.

No, EFF is simply wrong. The feature was never released, and instead of posting a "we screwed up" retraction EFF is now trying to shift blame.

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#128

Post by ansible »

Pxtl wrote: post #91
dhekir wrote: post #56

Earlier quoted context omitted.

I can choose not to install an app, but Google prevents me from doing it intelligently, that is, filtering the crappy apps demanding ridiculous permissions. I have to manually click on dozens of them before finding one that does not require, say, Internet access. APEFS ( http://www.bs.informatik.uni-siegen.de/forschung/apefs ) allowed such filtering, but since Google Play was updated some months ago, it stopped worki…

Exactly. The Play Store does not allow me to sort by permissions and doesn't display them up-front, making concern about permissions a fruitless endeavor. Give me a fuzzy-sort option where I can just apply weightings to how much I value out of (1) Permissions, (2) Popularity, (3) Price and (4) Relevance

Yes, exactly. I recently had to look through a dozen flashlight apps to find one that was non-scammy. Finally I found a couple that didn't require Internet access as well as personal information. Sheesh. Maybe I should have just written one myself.

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#129

Post by nitrogen »

Nursie wrote: post #72
nileshtrivedi wrote: post #65

Earlier quoted context omitted.

Here are the LWN articles on Device Tree from June/July. Not sure how things have changed: https://lwn.net/Articles/560523/ https://lwn.net/Articles/561462/

I'm not sure how things have changed yet either, and I certainly think Device Tree is an important step forward from each and every board having its own (mostly identical) code in the kernel tree. But you do still need the dts, so while it makes device support easier, it doesn't solve the problem of discoverable hardware and you still need board specs etc, either from the original manufacturer or reverse engineered.

So the next step is convincing manufacturers to put the .dts at a predictable location on a small flash or EEPROM.

Re: Google Removes Vital Privacy Feature From Android, Claims Release Was Accidental

#130

Post by nitrogen »

tomrod wrote: post #123
pjc50 wrote: post #113

Earlier quoted context omitted.

The touch keyboard lacks feedback but folds to zero size, which is its great advantage. And people are in practice getting along just fine with them, which is why the hardware keyboards have fallen by the wayside. The main obstacle to boot-your-own-phone in the US is of course the carriers.

> The main obstacle to boot-your-own-phone in the US is of course the carriers. Surely if it were profitably one of them would break ranks, right? I mean, we have intelligent businesspeople in telecoms at least occasionally?

By this assumption, surely everything that can be invented already has, right?
Post reply on HN