Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Google does not list application permissions in the Play Store any more

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 174 posts

Re: Tell HN: Google does not list application permissions in the Play Store any more

#141

Post by dlsa »

chias wrote: post #124
Groxx wrote: post #84

While it is much less of a concern with runtime permissions that are optional.... yeah, I greatly dislike this too. In particular because not everything is a runtime permission . E.g. I like to know that [apk X] has no internet or file permissions at all - it rules out nearly all practical ways to leak your information. And google just keeps taking more and more steps to hide that information from me.

My biggest pet peeve is optional runtime permissions that are not optional. I have a CO2 monitor that you read through an android app. It cost like $250. If you don't give it geolocation permission, it just says "this app needs geolocation permission" and shows you a button to go to your settings to enable it. Any time you disable geolocation, you get that message and button again. I have yet to find any geolocation…

The fact you couldn't find that reason yourself implies you could not have made an informed choice. You were effectively compelled. That isn’t permission consent. That was permission coercion. Being forced to consent isn't ethical.

Re: Tell HN: Google does not list application permissions in the Play Store any more

#142

Post by wakeupcall »

gene91 wrote: post #134
epukaza wrote: post #130

Earlier quoted context omitted.

The app needs the geolocation permission to access the bluetooth radio and scan for devices. Any company can can technically do geolocation using nothing but nearby bluetooth MAC addresses if they have location information for any other phone/device in bluetooth range.

What you said sounds plausible and I believe it. Assuming you’re right, it’s really sad that multiple sibling posts assume that the app was doing something shady and selling the user’s data. It shows, in general, how little trust people have in apps on their own phones.

I don't know about others, but thanks to a combination of protocols, google and law-enforcement my trust on phones and anything connected to it is basically zero, despite being quite secure on a technical level.

Re: Tell HN: Google does not list application permissions in the Play Store any more

#143

Post by tlavoie »

chias wrote: post #133
epukaza wrote: post #130

Earlier quoted context omitted.

The app needs the geolocation permission to access the bluetooth radio and scan for devices. Any company can can technically do geolocation using nothing but nearby bluetooth MAC addresses if they have location information for any other phone/device in bluetooth range.

Ah, that would make sense. It is indeed a bluetooth connection and it scans for any nearby devices. Thank you for clarifying that, I appreciate it, and I feel a lot better about the app!

Can you tell if that's all it does? I don't know what all geolocation covers in Android terms, but it would certainly be a superset of just scanning for BlueTooth.

I would be curious if it does any or all of:

- Fetching GPS coordinates, which are typically to many decimal places. - Making API requests to external servers that you don't own.

A tool like MobSF (https://mobsf.github.io) might be very enlightening to understand what a given app does, or at least can do. I've tinkered a bit with an iOS app in it, but not Android so far.

Also, proxying your device through Burp Suite or ZAP could also be interesting to see what traffic occurs, especially if the developers weren't picky about valid TLS certificates.

Re: Tell HN: Google does not list application permissions in the Play Store any more

#144

Post by unglaublich »

epukaza wrote: post #130
chias wrote: post #124

Earlier quoted context omitted.

My biggest pet peeve is optional runtime permissions that are not optional. I have a CO2 monitor that you read through an android app. It cost like $250. If you don't give it geolocation permission, it just says "this app needs geolocation permission" and shows you a button to go to your settings to enable it. Any time you disable geolocation, you get that message and button again. I have yet to find any geolocation…

The app needs the geolocation permission to access the bluetooth radio and scan for devices. Any company can can technically do geolocation using nothing but nearby bluetooth MAC addresses if they have location information for any other phone/device in bluetooth range.

With the proper permission set (neverForLocation), the OS shouldn't ask for geo-location permission. So the app seems malconfigured, or it's actually doing something with the Bluetooth beacons that it can't do otherwise.

https://developer.android.com/guide/topics/connectivity/blue...

Re: Tell HN: Google does not list application permissions in the Play Store any more

#145

Post by DoingIsLearning »

joecool1029 wrote: post #66
DoingIsLearning wrote: post #56

Earlier quoted context omitted.

I am very much fed up and ready to get on board with you but one thing that holds me back is photo quality. Nowadays camera sensors are only half the story and most of the iphone-like photo quality is achieved in software. Have we reached a point where non-OEM apps can deliver something comparable to the market expectations from big manufacturers? I am ok with narrow combinations e.g. if you use app X on Hardware Y y…

There's a whole GCam (Google Camera) modding community that manages to get image quality that's often better than what non-pixel OEM vendors offer. These ports usually work on LineageOS (and other ROMs) This site has a large collection of models and the config files generated for each device: https://www.celsoazevedo.com/files/android/google-camera/ I think they link to some Telegram channels too where people share t…

That is exactly the type of answer I was looking for, thank you.

Re: Tell HN: Google does not list application permissions in the Play Store any more

#146

Post by Schroedingersat »

gene91 wrote: post #134
epukaza wrote: post #130

Earlier quoted context omitted.

The app needs the geolocation permission to access the bluetooth radio and scan for devices. Any company can can technically do geolocation using nothing but nearby bluetooth MAC addresses if they have location information for any other phone/device in bluetooth range.

What you said sounds plausible and I believe it. Assuming you’re right, it’s really sad that multiple sibling posts assume that the app was doing something shady and selling the user’s data. It shows, in general, how little trust people have in apps on their own phones.

> Assuming you’re right, it’s really sad that multiple sibling posts assume that the app was doing something shady and selling the user’s data. It shows, in general, how little trust people have in apps on their own phones.

This is almost all apps. Your default assumption should be that anything on the big app stores is being as malicious as they can get away with -- especially if it is a forced install leveraging some product you have already purchased that could easily be sent over a standard protocol.

Re: Tell HN: Google does not list application permissions in the Play Store any more

#147

Post by jeffdubin »

no-reply wrote: post #121

Honest question, how many of us read permissions after scrolling through the description and then download ? It might make sense if you have metered bandwidth, not otherwise. I first try to find an ad-free app, install it and then see if it asks unnecessary permissions and go from there.

Yes. I check permissions on every app before I install it. Or, at least I did until that was recently taken away.

There are some permissions given to apps without a user prompt, e.g. start at boot. If there are five similar apps with similar functionality and ratings, I'll typically choose the one asking for the least permissions. And if I notice an app looking for excessive permissions (e.g. location) with no good reason why (e.g. a terminal app), that'll give me a clue that there's a ton of data being collected.

Once upon a time, a giant percentage of a device's user base was tech-savvy early adopters. But with billions of devices having been sold, 99%+ of Android users have very little interest in details like permissions.

But when these details are taken away... when I can't see permissions, when apps I use lose features because of new, restrictive Play Store policies, and when Android continues down this road of "privacy" without insight into exactly what my phone is doing... well, if I wanted this, I'd have chosen an Apple device.

Re: Tell HN: Google does not list application permissions in the Play Store any more

#148

Post by mrjin »

gene91 wrote: post #134
epukaza wrote: post #130

Earlier quoted context omitted.

The app needs the geolocation permission to access the bluetooth radio and scan for devices. Any company can can technically do geolocation using nothing but nearby bluetooth MAC addresses if they have location information for any other phone/device in bluetooth range.

What you said sounds plausible and I believe it. Assuming you’re right, it’s really sad that multiple sibling posts assume that the app was doing something shady and selling the user’s data. It shows, in general, how little trust people have in apps on their own phones.

Trust is earned not granted. You don't trust a random stranger walks by, why should anyone trust apps created by some random organizations? Especially given some calculator and similar apps came with a privacy statement, how much trust do you believe we should have in apps on our phones?

Re: Tell HN: Google does not list application permissions in the Play Store any more

#149

Post by eurasiantiger »

collaborative wrote: post #72
2OEH8eoCRo0 wrote: post #22

Earlier quoted context omitted.

It's funny how smart yet dumb A/B testing is. On one hand you can intelligently gauge the effect of changes, on the other hand you can push stupid shit since you have that power. How about intelligently designing applications that you yourself want to use? Too hard.

All the A/B tests I have done point to one conclusion: assume users are illiterate and have an attention span of 5 seconds

Keep it simple, stupid.

Re: Tell HN: Google does not list application permissions in the Play Store any more

#150

Post by MrDresden »

epukaza wrote: post #130
chias wrote: post #124

Earlier quoted context omitted.

My biggest pet peeve is optional runtime permissions that are not optional. I have a CO2 monitor that you read through an android app. It cost like $250. If you don't give it geolocation permission, it just says "this app needs geolocation permission" and shows you a button to go to your settings to enable it. Any time you disable geolocation, you get that message and button again. I have yet to find any geolocation…

The app needs the geolocation permission to access the bluetooth radio and scan for devices. Any company can can technically do geolocation using nothing but nearby bluetooth MAC addresses if they have location information for any other phone/device in bluetooth range.

This permission structure has now been split up in latest versions of Android to avoid this kinds of confusion.
Post reply on HN