Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We can't check the app permissions on Google Play anymore

bluespace.tech

Post reply on HN
Print view View original

71–80 of 121 posts

Re: We can't check the app permissions on Google Play anymore

#71

Post by dotancohen »

josephcsible wrote: post #56
dhzhzjsbevs wrote: post #46

I don't think I've checked permissions on the play store in ages. Don't apps prompt when they access things now? Speaking of which, anyone from Spotify around? Could you kindly take your request for control over Bluetooth and shove it up your fuckin arse? Why must I say no to this every time I open the app? No means no.

> Don't apps prompt when they access things now? For some permissions, but not all of them. For example, they don't for Internet access. > Why must I say no to this every time I open the app? Doesn't Android have a "don't ask again" option for permissions?

  > For some permissions, but not all of them. For example, they don't for Internet access.
Then why does this "Permission" exist? When will it ever be false?

Re: We can't check the app permissions on Google Play anymore

#72

Post by MrThoughtful »

tadfisher wrote: post #63
MrThoughtful wrote: post #33

What I always found very confusing is that apps on Android can either read all of the SD drive or nothing. Wouldn't the normal approach to gate applications from each other be to give each one the right to access a single directory? The way it is, all apps want to "READ_EXTERNAL_STORAGE" so they all can read all the data I save.

This is being clamped down on, at least for apps on the Play Store. How it works now is the app has unfettered access to its own internal and external storage directory, and can prompt the user to select another one to give access for saving additional data. There are some rough edges for implementors, though; for example, getting your content to show up in media player apps requires usage of a completely separate AP…

Where is this "own external storage directory"?

The behavior you describe is not what I experience in real life. I see apps being able to read and write from all directories on my SD card.

Re: We can't check the app permissions on Google Play anymore

#73

Post by MrThoughtful »

lupire wrote: post #37
MrThoughtful wrote: post #33

What I always found very confusing is that apps on Android can either read all of the SD drive or nothing. Wouldn't the normal approach to gate applications from each other be to give each one the right to access a single directory? The way it is, all apps want to "READ_EXTERNAL_STORAGE" so they all can read all the data I save.

Incorrect. Apps have private storage and shared storage, separate from fill disk access. https://developer.android.com/training/data-storage

That is not what I see on the page you linked to.

It says "READ_EXTERNAL_STORAGE when accessing other apps' files on Android 11 (API level 30) or higher"

So, as I understand it, a user has no way to allow an app to read only from a single directory on their SD card.

Re: We can't check the app permissions on Google Play anymore

#74

Post by bluecalm »

My idea to improve the issue is the following: an app asks for permissions and you as a user get two choices: grant the permission or grant mock permission. Mock permission gives access to some random data that like stock contacts/stock photos/whatever.

Every app is required to work correctly with the mock data or is removed from the store. You could even have mock folders in the photo app or mock contacts on your phone so you as a user can see how the app works on those without giving it access to the real stuff.

Example: a parking app asks for access to your contacts and ability to call, you give it a mock permission. It just works. When it tries to call someone you see info: "app XYZ calls mock contact A". When it tries to read your contacts it just gets a stock list. If it tries to tell you it needs real contacts you report it to Google and it gets removed.

Re: We can't check the app permissions on Google Play anymore

#76

Post by vinay427 »

ryandrake wrote: post #65
russdill wrote: post #38

Earlier quoted context omitted.

On a related note, I don't understand why apps are permitted to require you to enable certain permissions or refuse to run. What is the point of giving users control of their privacy if large popular apps are a able to essentially opt out of the optional part. I'm looking at you Kakao.

This case is clearly better on iOS. The AppStore guidelines require that your app functions regardless of whether the user consents to permissions. None of this bullshit “oh you denied this flashlight app contacts permission? Fuck you exit(0)”

The Google Photos app on iOS is still an egregious abuser of this, requiring access to all photos to run at all, rather than just selected photos or no photos at all. I’m still not sure why it would need that if I only intend on using it to access shared albums in the cloud, download photos, or view selected photos on my device, but it’s Google so I’m not terribly surprised.

Re: We can't check the app permissions on Google Play anymore

#77

Post by Gigachad »

beninsydney wrote: post #30
Gigachad wrote: post #25

Earlier quoted context omitted.

The permissions list on the play store was completely useless from a privacy standpoint. Even power users could to just about nothing with the info. The situation now where you approve or reject permissions as they are used in the app is vastly better than the original android model of being shown a wall of text with the options to either give away all of your data and security or not install the app.

The permissions list allowed you to make a better-informed decision before you download the app, even though you can't change what permissions an app requires you could shop around for apps without specific permissions. This was never incompatible with ad-hoc approving or rejecting permissions either.

This only works for utility apps which are really the minority of apps that users install. There is only one app to access my bank account, there is only one app to stream netflix on, there is only one app to access government services on.

Outside of flashlight and QR scanner apps, there is basically nothing the user can action aside from completely rejecting the wider service over some ambiguity in the permissions list.

Re: We can't check the app permissions on Google Play anymore

#78

Post by kramerger »

Kim_Bruning wrote: post #52

This is one reason I switched to F-Droid a while ago. Among other things, F-Droid is very strict about reporting potential anti-features, which (ironically?) makes me much more comfortable installing apps from that app-manager.

F-droid has one big anti feature itself: it tries to trick you to download their store app when all you want is to get the APK.

Gives me 2015 sourceforge vibes

Re: We can't check the app permissions on Google Play anymore

#79

Post by BoorishBears »

MrThoughtful wrote: post #73
lupire wrote: post #37

Earlier quoted context omitted.

Incorrect. Apps have private storage and shared storage, separate from fill disk access. https://developer.android.com/training/data-storage

That is not what I see on the page you linked to. It says "READ_EXTERNAL_STORAGE when accessing other apps' files on Android 11 (API level 30) or higher" So, as I understand it, a user has no way to allow an app to read only from a single directory on their SD card.

Read further:

> To give users more control over their files and to limit file clutter, apps that target Android 10 (API level 29) and higher are given scoped access into external storage, or scoped storage, by default. Such apps have access only to the app-specific directory on external storage, as well as specific types of media that the app has created.

If you really want to get into the weeds, previously you could work around scoped content requirements with the manifest property "requestLegacyExternalStorage"

But it's not respected if your app targets the latest version of Android, and new uploads have to target a recent enough version that the loophole is closed.

Legacy apps will be unaffected though.

Re: We can't check the app permissions on Google Play anymore

#80

Post by Gigachad »

david_allison wrote: post #31
Gigachad wrote: post #26

Earlier quoted context omitted.

Credit cards can not be duplicated wirelessly. I’m not familiar with passports but if they can then I’d say that’s a flaw of the cards rather than phone permissions. It’s possible to read nfc cards from quite a distance with a high power reader.

Do you have a source on that [credit cards]? From a casual further inspection, there are videos on YouTube which demonstrate this: https://www.youtube.com/watch?v=K_6oMZb8UOI

Someone else can probably give the technical details but from my understanding, all but the most primitive NFC cards use a challenge/response system rather than just an ID. So there is no way to actually clone the secret stored internally as this is never transmitted.

I'm willing to bet that video is just plain fake. Especially given it only has 2k views.

Post reply on HN