4 ms·

Android doesn't ask for user's permission before accessing the address book, is it?

ditojim 13y ago
yes, android requires user permission to access any data on your phone.
shocks 13y ago
When you install an Android app it lists the permissions you grant the app by continuing with the install. Contact access is one of these permissions.
gtaylor 13y ago
Android shows the permissions each app is requesting before you install, and even lets you know if they change their permissions between updates. While what Path did is crappy, they didn't subvert the Android permissions system. The thing that burnt the poster is that while a social app asking for access to their contacts might not rise a brow, the user has no way to know what they are going to do with that data without looking at the reviews or around the internet for complaints/testimonials.
- superuser2 13y ago
  But Android also doesn't allow you to deny specific permissions. It's all or nothing at time of install - if it ever gets location, it always gets location. This is one of the reasons I like iOS.
- pjbrunet 13y ago
  "Android shows the permissions each app is requesting before you install" Yes and no. Google often hides the most offensive permission requests under that "see more" arrow. And the permission requests (and accompanying explanations) are too vague and ambiguous. For example: Does "request access to network" mean they're able to sniff all my incoming/outgoing data, granting the app access to everything?
  - __chrismc 13y ago
    That, and the page is designed so most people will click the "Accept & Download" button without even reading the top-level permission requests. It's got the title and button at the top, taking up a large chunk of space (1/3rd on my Nexus 4), and then a vague list of - to most users - technical-sounding "stuff". My guess is a large majority of users never look past the button.
  - pjbrunet 13y ago
    Congrats __chismc. Shortly after this post it appears they moved the "Install" link under the permission requests.
clauretano 13y ago
It tells you the permissions requested by an app before you install it. For Path, see the "permissions" tab on this Play Store page https://play.google.com/store/apps/details?id=com.path&hl=en https://play.google.com/store/apps/details?id=com.path&h...
sp332 13y ago
Yes, you have to put this line in your app's manifest: <uses-permission android:name="android.permission.READ_CONTACTS"/> and the installer will prompt the user for that permission when they install the app.
VLM 13y ago
This doesn't sound very difficult to verify. Go to play.google.com. Search for path. First result in the app store. Click on Permissions. "This application has access to the following: ... blah blah blah ... This permission allows the app to use the camera at any time without your confirmation. ... blah blah blah ... read your contacts Allows the app to read data about your contacts stored on your tablet ... blah blah blah ... read call log Allows the app to read your tablet's call log, including data about incoming and outgoing calls. ... blah blah blah ... Now users have been trained to click "yes" to all requests without even reading them, so I you can get into philosophical arguments about if the "really" have permissions. Just like most users randomly click thru "click thru licences".
- ios84dev 13y ago
  Can you actually prevent an app from using one or more of those permissions? Like can I give it permission to my camera but not to the call log?
  - pkulak 13y ago
    No. Only on some custom Android builds.
  - georgemcbay 13y ago
    There is no official support for this AFAIK. Some 3rd party ROMs like Cyanogenmod have this functionality built in, though, and if you root your phone there are apps like "Permissions Denied" that you can run to do this. I'd assume the reason Google is somewhat hesitant to offer this officially is that many apps don't deal well with this -- some do degrade gracefully, while others end up throwing task-ending exceptions because the app code just never planned for not being able to do some task which requires permissions declared in the manifest.
    - ProblemFactory 13y ago
      There is a simple solution for managing permissions for poorly built apps: serve them empty or fake data. Every app already has to consider the case of GPS being unavailable indoors, the contact list only having one person (yourself) in it, or the camera picture being black in darkness.

yes, android requires user permission to access any data on your phone.

When you install an Android app it lists the permissions you grant the app by continuing with the install. Contact access is one of these permissions.

gtaylor 13y ago

Android shows the permissions each app is requesting before you install, and even lets you know if they change their permissions between updates. While what Path did is crappy, they didn't subvert the Android permissions system. The thing that burnt the poster is that while a social app asking for access to their contacts might not rise a brow, the user has no way to know what they are going to do with that data without looking at the reviews or around the internet for complaints/testimonials.

superuser2 13y ago
But Android also doesn't allow you to deny specific permissions. It's all or nothing at time of install - if it ever gets location, it always gets location. This is one of the reasons I like iOS.
pjbrunet 13y ago
"Android shows the permissions each app is requesting before you install" Yes and no. Google often hides the most offensive permission requests under that "see more" arrow. And the permission requests (and accompanying explanations) are too vague and ambiguous. For example: Does "request access to network" mean they're able to sniff all my incoming/outgoing data, granting the app access to everything?
- __chrismc 13y ago
  That, and the page is designed so most people will click the "Accept & Download" button without even reading the top-level permission requests. It's got the title and button at the top, taking up a large chunk of space (1/3rd on my Nexus 4), and then a vague list of - to most users - technical-sounding "stuff". My guess is a large majority of users never look past the button.
- pjbrunet 13y ago
  Congrats __chismc. Shortly after this post it appears they moved the "Install" link under the permission requests.

clauretano 13y ago

It tells you the permissions requested by an app before you install it. For Path, see the "permissions" tab on this Play Store page https://play.google.com/store/apps/details?id=com.path&hl=en https://play.google.com/store/apps/details?id=com.path&h...

sp332 13y ago

Yes, you have to put this line in your app's manifest: <uses-permission android:name="android.permission.READ_CONTACTS"/> and the installer will prompt the user for that permission when they install the app.

VLM 13y ago

This doesn't sound very difficult to verify. Go to play.google.com. Search for path. First result in the app store. Click on Permissions. "This application has access to the following: ... blah blah blah ... This permission allows the app to use the camera at any time without your confirmation. ... blah blah blah ... read your contacts Allows the app to read data about your contacts stored on your tablet ... blah blah blah ... read call log Allows the app to read your tablet's call log, including data about incoming and outgoing calls. ... blah blah blah ... Now users have been trained to click "yes" to all requests without even reading them, so I you can get into philosophical arguments about if the "really" have permissions. Just like most users randomly click thru "click thru licences".

ios84dev 13y ago
Can you actually prevent an app from using one or more of those permissions? Like can I give it permission to my camera but not to the call log?
- pkulak 13y ago
  No. Only on some custom Android builds.
- georgemcbay 13y ago
  There is no official support for this AFAIK. Some 3rd party ROMs like Cyanogenmod have this functionality built in, though, and if you root your phone there are apps like "Permissions Denied" that you can run to do this. I'd assume the reason Google is somewhat hesitant to offer this officially is that many apps don't deal well with this -- some do degrade gracefully, while others end up throwing task-ending exceptions because the app code just never planned for not being able to do some task which requires permissions declared in the manifest.
  - ProblemFactory 13y ago
    There is a simple solution for managing permissions for poorly built apps: serve them empty or fake data. Every app already has to consider the case of GPS being unavailable indoors, the contact list only having one person (yourself) in it, or the camera picture being black in darkness.