Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Google does not list application permissions in the Play Store any more

news.ycombinator.com

Post reply on HN
Print view View original

161–170 of 174 posts

Re: Tell HN: Google does not list application permissions in the Play Store any more

#161

Post by bornfreddy »

hackernewds wrote: post #153
bornfreddy wrote: post #17

LineageOS. Or Murena, if you can't be bothered to install it yourself. And then use f-droid, or if it's not available there, Aurora store. As seen on computers, OS is too important to be left to companies - if you value your freedom of choice and privacy, that is.

Enough people need to adopt them, for it to truly be effective. At which point they just become the new Google.

Not really, if anything, they (Murena) become new Canonical. There's still Debian (LineageOS in this case) when they overplay their hand (like Ubuntu is doing with snap).

Re: Tell HN: Google does not list application permissions in the Play Store any more

#162

Post by bagacrap »

anonymousiam wrote: post #88

One of the things I really liked about the Android custom ROMs (Cyanogen, etc.) was that they allowed you to revoke some app permissions, but still run the app. Google will never allow users to choose because it conflicts with their own business (user data collection and targeted marketing). Now they aren't even letting you know how much information the app collects until you download and install it.

Most Android app permissions are granted at runtime as of Android 6 which was released in 2015.

Re: Tell HN: Google does not list application permissions in the Play Store any more

#163

Post by hansvm »

gene91 wrote: post #134
epukaza wrote: post #130

Earlier quoted context omitted.

The app needs the geolocation permission to access the bluetooth radio and scan for devices. Any company can can technically do geolocation using nothing but nearby bluetooth MAC addresses if they have location information for any other phone/device in bluetooth range.

What you said sounds plausible and I believe it. Assuming you’re right, it’s really sad that multiple sibling posts assume that the app was doing something shady and selling the user’s data. It shows, in general, how little trust people have in apps on their own phones.

The Canon printer configuration app has the same sort of soft geo-permission lock. Sniff the network traffic right as you enable it, and you'll see your data happily find its way to their servers.

_Maybe_ the app is fine, but in the cases I've checked big corporations abusing your privacy is the norm.

Re: Tell HN: Google does not list application permissions in the Play Store any more

#164

Post by is_true »

bagacrap wrote: post #160
is_true wrote: post #15

Earlier quoted context omitted.

This clearly isn't OK. I want to choose between an app that asks for what it needs to work and an app that ask everything it can, before installing it. It's a dark pattern.

Don't you have more context to understand and grant the permission request at runtime? For example a banking app might want access to the camera for depositing checks, but until I'm actually depositing a check it might not be clear why it would want to use the camera.

You can ask later, too. But be clear upfront, I want to compare choices. Not many choices in that case in which you install the app your banks has.

Re: Tell HN: Google does not list application permissions in the Play Store any more

#165

Post by covermydonkey »

chias wrote: post #124
Groxx wrote: post #84

While it is much less of a concern with runtime permissions that are optional.... yeah, I greatly dislike this too. In particular because not everything is a runtime permission . E.g. I like to know that [apk X] has no internet or file permissions at all - it rules out nearly all practical ways to leak your information. And google just keeps taking more and more steps to hide that information from me.

My biggest pet peeve is optional runtime permissions that are not optional. I have a CO2 monitor that you read through an android app. It cost like $250. If you don't give it geolocation permission, it just says "this app needs geolocation permission" and shows you a button to go to your settings to enable it. Any time you disable geolocation, you get that message and button again. I have yet to find any geolocation…

A colleague of mine discovered his air monitoring device companion app was uploading to their website along with a map pin on his precise address. He wasn't too happy about that

Re: Tell HN: Google does not list application permissions in the Play Store any more

#166

Post by devit »

pavel_lishin wrote: post #34
devit wrote: post #9

Earlier quoted context omitted.

Just don't use proprietary applications (or don't expect them to serve you).

Isn't that equivalent to telling us not to install apps at all?

Use free and open-source ones like the built-in AOSP apps or the ones on F-Droid.

They have no incentive or resources to do A/B testing or make unnecessary UI changes.

Re: Tell HN: Google does not list application permissions in the Play Store any more

#167

Post by dotancohen »

rrrrrrrrrrrryan wrote: post #92
Gigachad wrote: post #86

Earlier quoted context omitted.

It was a bit of a pointless permission because literally every app requested it. The android permissions system very quickly fatigued users in to accepting everything. The new model is much better. Allow the user to actually deny the important permissions but just accept that network access is what apps do now.

I agree this is a better set of defaults, but there should be a toggle in the settings someplace, even deep in the developer mode settings, that gives users control over more granular permissions and allows them to choose which permissions to auto-grant and/or auto-deny.

Though I agree with you, why is this level of detail demanded of mobile apps but not of desktop apps? I would love to be able to sandbox desktop apps as well.

Re: Tell HN: Google does not list application permissions in the Play Store any more

#168

Post by aaaaaaaaata »

covermydonkey wrote: post #165
chias wrote: post #124

Earlier quoted context omitted.

My biggest pet peeve is optional runtime permissions that are not optional. I have a CO2 monitor that you read through an android app. It cost like $250. If you don't give it geolocation permission, it just says "this app needs geolocation permission" and shows you a button to go to your settings to enable it. Any time you disable geolocation, you get that message and button again. I have yet to find any geolocation…

A colleague of mine discovered his air monitoring device companion app was uploading to their website along with a map pin on his precise address. He wasn't too happy about that

"This dirtbag cares about the quality of his air! Get him!"

Re: Tell HN: Google does not list application permissions in the Play Store any more

#170

Post by nybble41 »

epukaza wrote: post #130
chias wrote: post #124

Earlier quoted context omitted.

My biggest pet peeve is optional runtime permissions that are not optional. I have a CO2 monitor that you read through an android app. It cost like $250. If you don't give it geolocation permission, it just says "this app needs geolocation permission" and shows you a button to go to your settings to enable it. Any time you disable geolocation, you get that message and button again. I have yet to find any geolocation…

The app needs the geolocation permission to access the bluetooth radio and scan for devices. Any company can can technically do geolocation using nothing but nearby bluetooth MAC addresses if they have location information for any other phone/device in bluetooth range.

> The app needs the geolocation permission to access the bluetooth radio and scan for devices.

Sure, but why does the app need to be able to scan for any and all Bluetooth devices? There should be an entry in the manifest describing the kind(s) of devices the app wants to interact with, and only those devices should appear in the scan. Naturally the list would need to be reviewed to verify that the selected devices are related to the app, and presented to the user in the app store along with all other requested permissions.

In this particular case the same company designed both the app and the device it's connecting to, so for all we know the device could have an embedded GPS receiver to provide the app with much more detailed location information than it could get from Bluetooth alone. It could also just relay its own Bluetooth scan results. However, the app at least couldn't easily get location data from Bluetooth scans when the device isn't in range.

Post reply on HN