Tell HN: Google does not list application permissions in the Play Store any more • Hacker News Board

Re: Tell HN: Google does not list application permissions in the Play Store any more

#171

Post by nybble41 » Mon, Jun 13, 2022, 4:29 PM UTC

thaumasiotes wrote: post #16

simonsarris wrote: post #2

That seems OK since it still asks you as it needs them when running an app, and "prunes" permissions away from apps that you do not use often. Lots of apps only need specific permissions if you use specific parts of the app. And apps are much larger (one app does more things) than they were 5-10 years ago. Eg you can use some apps as a camera, but never as a photo editor, and get use out of it by only giving some spe…

> That seems OK since it still asks you as it needs them when running an app, and "prunes" permissions away from apps that you do not use often. No no no no no, this is a total catastrophe. I can't understand how it got implemented at all. I just missed a birthday notification from my calendar app because Android "helpfully" removed the app's ability to create notifications! After all, I hadn't opened the calendar ap…

Fully agreed. What's worse, even if you painstakingly go through all your apps and disable this anti-feature—since there no global setting—it just gets turned back on the next time the app is updated. Putting aside the abysmal UX, automated systems should respect clearly-expressed user preferences.

Re: Tell HN: Google does not list application permissions in the Play Store any more

#172

Post by dontbenebby » Mon, Jun 13, 2022, 4:43 PM UTC

After all that research presented at fancy conferences about this topic, why would they then erase what little trust they had built up by making this change?

Re: Tell HN: Google does not list application permissions in the Play Store any more

#173

Post by nybble41 » Mon, Jun 13, 2022, 4:44 PM UTC

andreareina wrote: post #116

hugey010 wrote: post #113

Could this be because every privacy relevant permission, except internet access, now requires a manual approval dialog? Why list every permission when it's only used for specific feature X which is requested upon usage?

Because a lot of these apps claim such and such permission is required and won't run until you grant the permission

That sort of thing should be called out in (1-star) reviews.

The Samsung Gear app is like that, for example. You need it if you want to tweak the settings for their Galaxy Buds headset (the ambient sound level, for example), but on first startup it prompts for what appear to be all the permissions needed for every kind of Samsung device, including things like smartwatches—calendar, contacts, notifications, the works. If you deny any permission the app refuses to start, even though none of that is necessary for the task at hand.

My workaround was to install it and then immediately disable all Internet access (airplane mode), adjust the settings, and then purge the app from the phone before turning the network back on. Fortunately the settings are persistent even without a constant connection to the app. I think that should be sufficient to avoid any unwanted data leakage, but it's a lot of work for relatively minor benefit, and the process must be repeated any time the settings need to be adjusted.

Re: Tell HN: Google does not list application permissions in the Play Store any more

#174

Post by nybble41 » Mon, Jun 13, 2022, 4:53 PM UTC

bagacrap wrote: post #162

anonymousiam wrote: post #88

One of the things I really liked about the Android custom ROMs (Cyanogen, etc.) was that they allowed you to revoke some app permissions, but still run the app. Google will never allow users to choose because it conflicts with their own business (user data collection and targeted marketing). Now they aren't even letting you know how much information the app collects until you download and install it.

Most Android app permissions are granted at runtime as of Android 6 which was released in 2015.

Unfortunately apps can refuse to run if you don't grant them the permissions they requested. A better system than simply allowing or denying the request would be to sandbox the app so that it appears to receive the permission but doesn't get access to any useful capabilities. Empty or synthetic calendar / contact list data, Internet access which is somehow never available, camera and microphone which only report darkness & silence, etc. Ideally the app would have no way to tell that it's been sandboxed.