> If nobody has any reason to “only claim what they need”, then why would they?
That's a reasonable question that at first glance seems to have an obvious answer.
And yet, the web works. The web works brilliantly -- the web isn't perfect by any metric, but it is still almost objectively the most secure general-user computing platform that we have today. There are a lot of reasons for that, including just locking down capabilities in general, but where permissions are specifically concerned:
- The current permissions model that platforms including iOS are moving towards is granting permissions piece-meal post-install. Asking for lots of permissions up-front looks a lot more skeezy in this world, which reduces user trust. I particularly respect that iOS pops up reminders of what permissions you've granted apps, I think that's a brilliant UX move, and I wish other platforms would copy it.
- The more sophisticated model that Firefox/Chrome are starting to play with (and that I suspect more platforms are going to adopt in the future) is that apps can't ask for permissions directly, users need to grant them themselves by going out of their way, which helps cut down on people mindlessly clicking OK on everything that pops up and introduces a UX/development cost for apps that want to enable tons of permissions, because they now need to explain to users what to click on.
- The really sophisticated model that people are looking into for stuff like filesystem access is that the app never knows whether or not a permission was granted. If it asks for location, it gets an incorrect answer. If it asks for access to your media files, it gets a blank folder with nothing in it. Under this model, the app is completely isolated by default, and never knows how many permissions the user has granted it, so it never knows whether or not to ask for more of them.
So this is one of those questions that intuitively points towards moderation, but in practice we're starting to learn that with good UX there are a lot of ways to teach ordinary people to be safe, and there are a lot of ways to restrict apps without encouraging users to circumvent those restrictions.
Of course, I don't think it's impossible that app store moderation helps security. I mean, certainly moderation helps on some level. I suspect it doesn't help as much as people assume, just based on what moderation looks like across the entire industry right now. But I'm not going to die on that hill.
I just don't think people should blanketly assume that's the case. MacOS also has a better security track record than Windows even when you're not running Gatekeeper apps, and even though MacOS doesn't force apps to go through a moderator. Any user can bypass Gatekeeper, but through a combination of multiple factors, MacOS still has less malware than Windows/Android.
People look at iOS and Android and make very strong claims based on two environments that are substantially different on multiple security axes: in terms of sandboxing, in terms of market share, in terms of userbase demographics. There's a lot of stuff at play here, and there are multiple ways that platforms (including iOS) are trying to create the economics you're talking about. Even iOS is not all-in on moderation, even iOS is trying to train its users at least to some degree to think about their own security.