8 ms·

Android: I don't need your permission

540 points by dopkew 12y ago

JoshTriplett 12y ago
This makes it all the more egregious that so many applications ask for permission to access contacts and similar. Perhaps Android should rephrase these permissions as, for instance "direct access to contacts without your knowledge", as opposed to "access to user-selected contacts upon request" (which, as demonstrated, does not need permission).
- digi_owl 12y ago
  Given that Google has gone to lengths to obfuscate the permissions further in Play, i don't think that is likely to ever happen...
digi_owl 12y ago
Best i can tell, quite a few requested permissions do not come from the developer. Instead it is the defaults of some framework or other the developer used to handle some of the nitty gritty details, like the ads.
- bbcbasic 12y ago
  Admob only requires internet permissions, at least last time I used it.
- king_jester 12y ago
  This is one of those weaknesses about 3rd party dependencies on Android. Unless business and product teams value user privacy and permissions, they usually could care less than vendor X's library requires permissions to read phone state or contacts when your app itself doesn't need it. Esp. given that iOS treats permissions differently, the distinction is often ignored in favor of whatever iOS does. To those managers, the fact that Android doesn't ask the user about using a permission is a happy coincidence.
- rogerbinns 12y ago
  Another angle being missed is that Android won't auto-update apps if they have new permissions (modulo some minor details). The developers I worked with always added more permissions to their initial app versions for things they weren't using, but might in the future.
  - digi_owl 12y ago
    That is a Play thing, not a Android thing, iirc. Still, with the latest change in permissions handling in Play, it will happily auto-update an app if the new permission(s) are in the same category as a previous one...
blacksmith_tb 12y ago
Another reminder of how eagerly I await Xposed / Xprivacy on ART for 5.0... that said, his examples are fairly benign, I agree that if your app needs to initiate a call, it should show me the dialer to see if I would like to do that now, or some other time (including never).
- delecti 12y ago
  If you're just waiting for permission controls, App Ops [1] should work just fine on 5.0. There are other comparable apps that also don't require Xposed. [1] https://play.google.com/store/apps/details?id=com.findsdk.apppermission https://play.google.com/store/apps/details?id=com.findsdk.ap...
ctz 12y ago
The same goes for android.permission.INTERNET. Apps can open arbitrary URLs in the browser (which load without user intervention).
- tjbiddle 12y ago
  However that's not the only use case for android.permission.INTERNET - you need it for anything that does networking on the internet, such as API calls to your web application.
  - lucas-be 12y ago
    So the entire computer world had run like this for decade. why are people complaining about that now? Because Apple is doing strict verification of your code behaviour? Yesterday adobe pdf viewer tell me that an update was available both on my mac and pc! So without asking my permission, this computer application (and many others) are querying the web...
    - sharjeel 12y ago
      The PCs didn't sit in your pocket all data with sensing GPS location, mic, camera, footsteps, discovery of bluetooth and wifi devices around you; neither were they single point of communication with the rest of the world.
      - lucas-be 12y ago
        Not as long as you have not synchronized your phone with a cloud service (ICloud, Google drive, etc.) on which your PC/MAC is connect too.
    - pbhjpbhj 12y ago
      >So without asking my permission // You give your permission when you install it with auto-update enabled. I always disable auto-update.
      - 12y ago
CSDude 12y ago
This is the another reason I use CyanogenMod. It has Privacy Guard and I can disable the nasty permissions as I please. If you have Android 4.3+, you can also install it indivudally https://play.google.com/store/apps/details?id=com.findsdk.apppermission https://play.google.com/store/apps/details?id=com.findsdk.ap... (requires root I guess) The most helpful one, even if you are not privacy/security concerned is to disable wake up/keep awake requests, which Facebook and FB Messenger used it apporximately 6800 times since I installed my clean rom 1 week ago.
- dozy 12y ago
  I love CyanogenMod (or at least the concept...I'm over dealing with the headache in practice), but the reason I used it was certainly not for improved stability and security. Not that I particularly trust OEMs/carriers, but the only way I'd feel more secure with CyanogenMod is if I had time to audit the source and build the kernel and OS binaries myself, and that includes whatever code is used to root and unlock your device in the first place. If you do that though, more power to ya. Also, disabling permissions at runtime is a foolproof way to make an app crash, as the vast majority of apps will assume they're granted the permissions hardcoded in the manifest at compile time. One last point - rooting your phone and granting apps root access just to disable crucial permissions such as holding a wakelock seems pretty reckless - have you personally seen the source code for that app? At least the dev's website seems legit: http://www.findsdk.com/ http://www.findsdk.com/ EDIT: Even better, looks like the author of App Ops, or at least the owner if the findsdk.com domain, is in China :) https://who.is/whois/findsdk https://who.is/whois/findsdk
  - aeroevan 12y ago
    IIRC, Privacy Guard simply returns empty sets of data instead of just revoking the permissions so the app shouldn't crash. It probably will lose functionality, but by actively turning on PG you're signing up for that.
  - Groxx 12y ago
    CyanogenMod's "deny permission" behavior is largely the same as XPrivacy's, but way less fine-grained (and way easier to use). Basically it just returns "empty" data for requests - it doesn't revoke the permission, because yes, that would cause crashes. The vast majority of applications work with this with no problems. They just won't e.g. show your contacts.
Fradow 12y ago
The theory seems great. The reality is not. When you do that, you delegate your UX and proper functionning of your app to a third-party app. The UX can vary according the app. One thing is certain, it won't always be consistent with your app. It is also going to be more complicated for the user (more actions to make, more choices, just because you don't want to add permissions). The proper functionning is even worse. Did you ever heard about the fragmentation of Android? Well, Intents are where it's worse. Some apps plainly don't work, or are buggy. Intents are great to save time prototyping something. However, if a feature is central to your app, you are better off ensuring yourself that it works well and is easy to use, something that Intents can't guarantee. Of course, the permission system is far from ideal, and some people will not install your app because you ask for some permissions. I'd say that's a price to pay for developping on Android. P.S.: some examples of Intents that don't work so well: 1) sending a mail. Good luck finding how to properly use an Intent that is not handled by text apps and allow you to put attachments 2) picking a photo from gallery and resize. A lot of photo apps are plain broken for that Intent. And I'm not talking about some obscure device on a rooted Android, I'm talking about Google's Nexus, with stock apps.
- Pxtl 12y ago
  Thinking like this is what led to so many terrible '90s windows apps eschewing the Common Dialog box for file management. We all eventually accepted that you should let the OS do its native thing. Android is no different.
Someone1234 12y ago
> If your app is closed-source then they have no way of verifying you're not downloading all their contacts to their servers. That's a common fallacy. Even if it is open source someone could still be doing that. In order to be secure you would have to: A) Download the source yourself B) Inspect the source C) Compile the source Just because you have the source doesn't mean what you get from the Play Store/Amazon App store is 1:1 identical or even similar. There is secret option D, have someone you trust do A through C and then give you the hash of the resulting compiled file. But two programs compiled on two machines often give different results due to library versions, compiler versions, environmental settings, and so on.
- foo2312 12y ago
  It may seem a bit silly to add this, but I think it is good to link the reference for those who may not have seen it before: Even compiling from source, one also has to trust the compiler... (see, e.g. the classic http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html, pdf version at https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...)
  - tormeh 12y ago
    And then you have to trust the OS. And the machine... Unless you build you computer yourself from silicon, you're not going to get rid of trust.
    - GauntletWizard 12y ago
      Then you would also have to trust that your knowledge of how silicon processing and manufacture is correct, and that whomever taught you how to do so was not malicious. At some point, it all becomes a circlejerk of Cartesian doubt.
    - senko 12y ago
      Further reading: http://en.wikipedia.org/wiki/Trusted_computing_base http://en.wikipedia.org/wiki/Trusted_computing_base
deleted 12y ago
[deleted]
bndw 12y ago
I made app ethics[1] a while back in hopes to surface what some of the android permissions mean. [1] http://appethics.org http://appethics.org
Fando 12y ago
Good article. As good as Google's permission system is, it lacks obvious features. Maybe I'm missing something, but I think that Android permission are overly general and not specific enough in a majority of apps.
- DeepDuh 12y ago
  As good as it is? I find it pretty terrible, at least for me it singlehandedly makes me not want to use Android.
avz 12y ago
I would be very happy if instead of preventing me from installing apps which require a given permission, Android would let me install them at my own risk in a sandbox which provides the app with dummy data and interactions (whether from a sensor, contacts db, camera etc). It would be even better if the framework explicitly supported running apps without the necessary permissions and simply threw some sort of PermissionException. This would cripple some functionality while preserving the rest. Developers could of course write the apps to not work under such reduced conditions, but Google Play could reject such apps.
- matkam 12y ago
  Android had a hidden feature in certain iterations of Android 4, called "App Ops," that would let you do this but it never made it to prime time. Though Cyanogenmod does leverage it for their "Privacy Guard" feature.
- brk 12y ago
  This sounds like a great way for paranoid but uninformed users to break lots of apps, and then blame the developer/phone/carrier (in any random order). We sometimes forget that really with smartphones the manufacturers are trying to produce something for the masses. This would also seem to include reducing the amount of security consciousness the user needs to have in order to have an "acceptable" experience with the device.
  - eslaught 12y ago
    And yet, the iPhone basically does this for a number of permissions (location, push notifications, contacts access, etc.), and for the most part it seems to work for even uneducated users of iOS. For most permissions, you might not want this, but for some of the more sensitive and personal-information rich sources, this is a really highly desirable feature.
jbk 12y ago
I wish it was that easy in all cases. For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service). The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work. But on the play store it's written "read phone status and identity" and that's really really scary for the users. And even if we're 100% open source, so people can check the application, and even people recompile VLC, this is a complaint we receive a lot...
- aferreira 12y ago
  Actually, I don't think you need it. If you can request permission to read the list of activities and do so when your activity is paused, you can search for the phone application (or even similar ones, such as Skype) and pause your audio playback? Just a thought.
  - learnstats2 12y ago
    "Check out everything I do with my phone" is one of the permissions I would be more concerned about giving up.
  - masklinn 12y ago
    That the phone application is launched does not mean the user is currently in a call, they could be browsing their contacts list.
    - jbk 12y ago
      That too.
    - mcintyre1994 12y ago
      Skype is an even worse example too, I use it for IM more than calls and it presumably stays open for a long time, probably forever on those occasions.
stevebot 12y ago
Just curious though for these specific examples as it says "if you read the source", could these intent's change in future releases, or is it documented outside of the source and accepted that using these intents is not relying on Android internals that could change?
habosa 12y ago
There are two additions to the permissions API that I think would be very helpful: 1) Incremental Authorization - let Android apps ask for permissions only as they need them. So if you never use the phone dialing feature, they never ask for the permission. 2) One-time auth - allow an Android app to do something once. Say, scan your contacts one time. This gives you a little more control, so you know the dev isn't monitoring your phone at 3am. Here is the problem though: most people don't actually care. The vocal minority cares, but most Android users don't know what a permission is if you ask them. So all that developers get for trying to work around permissions is less people using their app or less features in the app. Sadly there is no real incentive for a developer to be sparing with permissions for apps that target the mass market.
- Aldo_MX 12y ago
  1) Incremental Authorization - let Android apps ask for permissions only as they need them. So if you never use the phone dialing feature, they never ask for the permission. Not only incremental authorization, but the ability of denying specific permissions.
  - click170 12y ago
    Take it a step further, I should be able to forge the contacts in my address book, my GPS coordinates, the list of installed apps.. The list goes on. But I would happily start with incremental permissions. Baby steps.
    - 9mit3t2m9h9a 12y ago
      As far as I understand, there is an option that is even simpler for application developers: all applications have the permissions to see and alter whatever they want on the phone, up to a storage quota for modifications. Most of their accesses are hellbanned, though… Hellbanning logic can be altered by applications (obviously, the user would have to allow the configuration application to access the real settings), so granularity can be added as a bolt-on. But I guess giving users actual security and privacy is against both Google's and Apple's interest, so this can only exist on a custom ROM without Google Play Services (or with sandboxed Google Play Services, which is probably against EULA).
ww520 12y ago
This is classic privilege elevation via a 3rd party privileged process. I thought Android's permission system carrying the security context from app to app through Intent. Guess the assumption is wrong. In most OS, the security token/context of the initiating process is carried over to the target process when it's asked to do something on behalf of the initiating process via IPC so that the target process runs at the privilege level of the initiating process even if the target process has a higher privilege to start with.
jonalmeida 12y ago
In the example about the phone call, you could give the user the option to hit the call button, but once this is complete a dialog should popup saying, "Do you want this to happen automagically henceforth?" which would then take full use of the Phone permission. This would also allow permissions to be toggled on/off, which a feature I really want in Android.
tn13 12y ago
I think all apps should be given a choice to have ephimeral permission. For example I dont want someone to find an exploit in my app and steal my user's contacts. I would only take contacts permission when I need and keep it for a short duration and then willingly give it up. User can be explicitly prompted. Also, Camera and Microphones should have only this sort of permissions other than for those which are explictily whitelisted by Google.
swatow 12y ago
This is interesting because it's essentially the same security model as the web. Your app runs in a controlled environment, and it has the option to nest another app (on the web, in an iframe) which it can send messages to, but can't affect the code or UI of. The fact that the UI cannot be manipulated by the nesting app, is crucial, since it allows the security model to tie certain user actions, like pressing dial, to certain actions, like making a phone call.
clumsysmurf 12y ago
In the case of bluetooth, you can either (1) request BLUETOOTH_ADMIN permission and enable BT yourself, or (2) ask Android to show an "Enable Bluetooth Dialog" (BluetoothAdapter.ACTION_REQUEST_ENABLE) which doesn't require that permission. But #2 has been busted for a while https://code.google.com/p/android/issues/detail?id=60002 https://code.google.com/p/android/issues/detail?id=60002 They didn't fix it, and marked it obsolete. So I guess we need BLUETOOTH_ADMIN after all.
robert_tweed 12y ago
> Case in point: android.permission.CALL_PHONE. You need it to initiate phone calls from your app, right? This kind of thing is why I can't see myself switching to Android as my primary mobile OS any time soon. If anything, I can see a bright future for Microsoft. In spite of the fact Windows Phone exists, Android is very much the Windows of the mobile ecosystem. Permissions on Android are horrendous for developers. But they are even worse for users. If a developer can't tell the difference between ACTION_CALL and ACTION_DIAL, what chance does the average end-user have? And when every app requests at least half a dozen permissions, how many users are going to carefully review each and every permission and how many are just going to give up and grant all requested permissions to every app the way that everyone reflexively clicks "agree" to every online ToS? Even if Android actually had a working method to deny individuals permissions, nobody ever has any idea which permissions are essential to which classes of app and which should be treated with suspicion. Compare this to iOS, where you may occasionally get asked to grant an app access to contacts or location - this is a rare occurrence and you can choose deny every time with no negative consequences (except for restricting that functionality). The comment by jbk illustrates just how big a mess permissions on Android are, beyond just being confusing. On top of that you've got custom intents, which while a great idea on paper, just pile more complexity on top of a broken foundation of complexity and obfuscation. This IMO is the single biggest thing wrong with Android, which Google should prioritise fixing like Microsoft in 2002. Never mind signed-app stores like Play: the fundamentally broken security model is the reason why Android is the only mobile platform to have a problem with malware. It's also a brilliant case study in over-engineering with a complete failure to consider human psychology.
- pjmlp 12y ago
  > If anything, I can see a bright future for Microsoft. I have both Android and Windows Phones. The Windows Phone is actually quite good and from developer point of view, a pleasure compared with Android tooling and APIs. Just the way Microsoft behaved with the customers has made many look elsewhere.
  - clumsysmurf 12y ago
    I've been developing for Android since 2009. I also own Windows Phones too. I prefer WP. If WP would achieve just 10% market share in my country, I'd drop Android in a heartbeat. My app deals primarily with Bluetooth BR/EDR + BLE comms to to external devices. Its been nonstop bugginess. Nevermind Wifi Direct, which I can't get working on a good day. I keep hoping the opengarden guys will be able to overcome the crappy Android apis.
blueskin_ 12y ago
This is why I love xprivacy. It gives me a popup when an app tries to access something, and I can whitelist or blacklist it, either on a temporary or permanent basis. Unlike google's halfarsed attempt at a privacy layer, it also doesn't give an exception when an app tries to access restricted data as that can cause apps to crash; it just sends back fake data (device ID is DEFACE, contacts are empty, location is christmas island, etc.). It also covers just about every permission you can think of, unlike app ops/privacy guard that are just a few. Although really, what needs to change isn't just in android itself; it's also developer behaviour. Stop trying to do intrusive things like prefilling forms, as it doesn't benefit the user in any real way.
- mcherm 12y ago
  > Stop trying to do intrusive things like prefilling forms, as it doesn't benefit the user in any real way. Speak for yourself -- I find prefilled forms to be a time-saver. However, I don't want apps trying to read through my contacts in order to do it. What I want (but haven't actually configured) is xprivacy configured to make contacts appear empty.
  - blueskin_ 12y ago
    When an app tries to read your contacts, it gives a popup showing contacts as the item accessed; uncheck 'once' and click deny.
_s 12y ago
Crazy theory but stick with me please - Why aren't we as users allowed to fine grain the data on our device that we want the app to have access to? A benign example would be a camera app; it wants access to my camera and mic, perhaps the local storage. It may have further features to store images in it's cloud service, assign the image to a contact and so forth. But as a user I only want the app for it's picture taking ability - the app requests at the point of installation the permissions it requires, and I only grant it access to the camera. It's then down to the app / developer to handle the exceptions and offer a message saying "You have taken a picture, but the app doesn't have permission to save it to storage. Please allow access by clicking here, otherwise this feature will not work/be unavailable". A bit more of effort on the developers part, no question - but a user than has complete control over what an app can access. I'm not an app developer, but skimming over how intents work and chiming along with this article - I don't think it would be a significant change to the underlying structure of android to hand back specific permission controls to a user.
- facepalm 12y ago
  I think it is not done that way because it would overwhelm most users. Maybe it could be some kind of expert mode, though. Don't some Android mods (like Cyanogen) allow you to do that?
- berkut 12y ago
  I guess the app would have to handle not being allowed permission to do these things gracefully. That's possibly a tall order based on my experience with apps these days, although for a difference reason: a lot of them assume there's internet connectivity, which isn't always the case, and a lot of apps don't handle this gracefully at all, even for doing things like opening maps, finding location, turning data off, going to another app, then back to maps again, and it takes ages for it to display because it's expecting to have network access.
snake_plissken 12y ago
I recently got a Moto E as my first smart phone, ever, and after checking out some apps, I was astounded and befuddled by the access permissions that it seems every app needs. Take ESPN's fantasy football app, which requires: device and app history - whats apps are running, browsing history, bookmarks identity - accounts on the device, profile data photo/media/files - access to files on the device and the device's external storage wi-fi connection information - whether wi-fi is enabled, names of connected wi-fi devices device ID and call information - determine the phone number and device IDs, whether a call is active, and the remote number connected by a call I can understand why it might need access to the file system to, for example, upload an avatar. The access to wi-fi seems innocuous, although I would expect something like network connectivity and status to be delegated to a kernel module or background daemon with which an app interfaces. But is there any legitimate (i.e. some non-financial oriented mine as much data as possible) reason it needs to be able to see what other apps are running, my browser history or who is on the other end of a call? There might not be any reason, and ESPN could potentially build the app to have as many or as few permissions as they deem valuable, because people want an app to manage fantasy football teams first. While this example might not be the best, since ESPN is a huge brand and there is no alternative if they are hosting your league, the situation was the same with so many other apps; just absurd permission requirements. None were installed.

540 points by dopkew 12y ago

This makes it all the more egregious that so many applications ask for permission to access contacts and similar. Perhaps Android should rephrase these permissions as, for instance "direct access to contacts without your knowledge", as opposed to "access to user-selected contacts upon request" (which, as demonstrated, does not need permission).

digi_owl 12y ago
Given that Google has gone to lengths to obfuscate the permissions further in Play, i don't think that is likely to ever happen...

digi_owl 12y ago

Best i can tell, quite a few requested permissions do not come from the developer. Instead it is the defaults of some framework or other the developer used to handle some of the nitty gritty details, like the ads.

bbcbasic 12y ago
Admob only requires internet permissions, at least last time I used it.
king_jester 12y ago
This is one of those weaknesses about 3rd party dependencies on Android. Unless business and product teams value user privacy and permissions, they usually could care less than vendor X's library requires permissions to read phone state or contacts when your app itself doesn't need it. Esp. given that iOS treats permissions differently, the distinction is often ignored in favor of whatever iOS does. To those managers, the fact that Android doesn't ask the user about using a permission is a happy coincidence.
rogerbinns 12y ago
Another angle being missed is that Android won't auto-update apps if they have new permissions (modulo some minor details). The developers I worked with always added more permissions to their initial app versions for things they weren't using, but might in the future.
- digi_owl 12y ago
  That is a Play thing, not a Android thing, iirc. Still, with the latest change in permissions handling in Play, it will happily auto-update an app if the new permission(s) are in the same category as a previous one...

blacksmith_tb 12y ago

Another reminder of how eagerly I await Xposed / Xprivacy on ART for 5.0... that said, his examples are fairly benign, I agree that if your app needs to initiate a call, it should show me the dialer to see if I would like to do that now, or some other time (including never).

delecti 12y ago
If you're just waiting for permission controls, App Ops [1] should work just fine on 5.0. There are other comparable apps that also don't require Xposed. [1] https://play.google.com/store/apps/details?id=com.findsdk.apppermission https://play.google.com/store/apps/details?id=com.findsdk.ap...

ctz 12y ago

The same goes for android.permission.INTERNET. Apps can open arbitrary URLs in the browser (which load without user intervention).

tjbiddle 12y ago
However that's not the only use case for android.permission.INTERNET - you need it for anything that does networking on the internet, such as API calls to your web application.
- lucas-be 12y ago
  So the entire computer world had run like this for decade. why are people complaining about that now? Because Apple is doing strict verification of your code behaviour? Yesterday adobe pdf viewer tell me that an update was available both on my mac and pc! So without asking my permission, this computer application (and many others) are querying the web...
  - sharjeel 12y ago
    The PCs didn't sit in your pocket all data with sensing GPS location, mic, camera, footsteps, discovery of bluetooth and wifi devices around you; neither were they single point of communication with the rest of the world.
    - lucas-be 12y ago
      Not as long as you have not synchronized your phone with a cloud service (ICloud, Google drive, etc.) on which your PC/MAC is connect too.
  - pbhjpbhj 12y ago
    >So without asking my permission // You give your permission when you install it with auto-update enabled. I always disable auto-update.
    - 12y ago

CSDude 12y ago

This is the another reason I use CyanogenMod. It has Privacy Guard and I can disable the nasty permissions as I please. If you have Android 4.3+, you can also install it indivudally https://play.google.com/store/apps/details?id=com.findsdk.apppermission https://play.google.com/store/apps/details?id=com.findsdk.ap... (requires root I guess) The most helpful one, even if you are not privacy/security concerned is to disable wake up/keep awake requests, which Facebook and FB Messenger used it apporximately 6800 times since I installed my clean rom 1 week ago.

dozy 12y ago
I love CyanogenMod (or at least the concept...I'm over dealing with the headache in practice), but the reason I used it was certainly not for improved stability and security. Not that I particularly trust OEMs/carriers, but the only way I'd feel more secure with CyanogenMod is if I had time to audit the source and build the kernel and OS binaries myself, and that includes whatever code is used to root and unlock your device in the first place. If you do that though, more power to ya. Also, disabling permissions at runtime is a foolproof way to make an app crash, as the vast majority of apps will assume they're granted the permissions hardcoded in the manifest at compile time. One last point - rooting your phone and granting apps root access just to disable crucial permissions such as holding a wakelock seems pretty reckless - have you personally seen the source code for that app? At least the dev's website seems legit: http://www.findsdk.com/ http://www.findsdk.com/ EDIT: Even better, looks like the author of App Ops, or at least the owner if the findsdk.com domain, is in China :) https://who.is/whois/findsdk https://who.is/whois/findsdk
- aeroevan 12y ago
  IIRC, Privacy Guard simply returns empty sets of data instead of just revoking the permissions so the app shouldn't crash. It probably will lose functionality, but by actively turning on PG you're signing up for that.
- Groxx 12y ago
  CyanogenMod's "deny permission" behavior is largely the same as XPrivacy's, but way less fine-grained (and way easier to use). Basically it just returns "empty" data for requests - it doesn't revoke the permission, because yes, that would cause crashes. The vast majority of applications work with this with no problems. They just won't e.g. show your contacts.

Fradow 12y ago

The theory seems great. The reality is not. When you do that, you delegate your UX and proper functionning of your app to a third-party app. The UX can vary according the app. One thing is certain, it won't always be consistent with your app. It is also going to be more complicated for the user (more actions to make, more choices, just because you don't want to add permissions). The proper functionning is even worse. Did you ever heard about the fragmentation of Android? Well, Intents are where it's worse. Some apps plainly don't work, or are buggy. Intents are great to save time prototyping something. However, if a feature is central to your app, you are better off ensuring yourself that it works well and is easy to use, something that Intents can't guarantee. Of course, the permission system is far from ideal, and some people will not install your app because you ask for some permissions. I'd say that's a price to pay for developping on Android. P.S.: some examples of Intents that don't work so well: 1) sending a mail. Good luck finding how to properly use an Intent that is not handled by text apps and allow you to put attachments 2) picking a photo from gallery and resize. A lot of photo apps are plain broken for that Intent. And I'm not talking about some obscure device on a rooted Android, I'm talking about Google's Nexus, with stock apps.

Pxtl 12y ago
Thinking like this is what led to so many terrible '90s windows apps eschewing the Common Dialog box for file management. We all eventually accepted that you should let the OS do its native thing. Android is no different.

Someone1234 12y ago

> If your app is closed-source then they have no way of verifying you're not downloading all their contacts to their servers. That's a common fallacy. Even if it is open source someone could still be doing that. In order to be secure you would have to: A) Download the source yourself B) Inspect the source C) Compile the source Just because you have the source doesn't mean what you get from the Play Store/Amazon App store is 1:1 identical or even similar. There is secret option D, have someone you trust do A through C and then give you the hash of the resulting compiled file. But two programs compiled on two machines often give different results due to library versions, compiler versions, environmental settings, and so on.

foo2312 12y ago
It may seem a bit silly to add this, but I think it is good to link the reference for those who may not have seen it before: Even compiling from source, one also has to trust the compiler... (see, e.g. the classic http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html, pdf version at https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...)
- tormeh 12y ago
  And then you have to trust the OS. And the machine... Unless you build you computer yourself from silicon, you're not going to get rid of trust.
  - GauntletWizard 12y ago
    Then you would also have to trust that your knowledge of how silicon processing and manufacture is correct, and that whomever taught you how to do so was not malicious. At some point, it all becomes a circlejerk of Cartesian doubt.
  - senko 12y ago
    Further reading: http://en.wikipedia.org/wiki/Trusted_computing_base http://en.wikipedia.org/wiki/Trusted_computing_base

deleted 12y ago

[deleted]

bndw 12y ago

I made app ethics[1] a while back in hopes to surface what some of the android permissions mean. [1] http://appethics.org http://appethics.org

Fando 12y ago

Good article. As good as Google's permission system is, it lacks obvious features. Maybe I'm missing something, but I think that Android permission are overly general and not specific enough in a majority of apps.

DeepDuh 12y ago
As good as it is? I find it pretty terrible, at least for me it singlehandedly makes me not want to use Android.

avz 12y ago

I would be very happy if instead of preventing me from installing apps which require a given permission, Android would let me install them at my own risk in a sandbox which provides the app with dummy data and interactions (whether from a sensor, contacts db, camera etc). It would be even better if the framework explicitly supported running apps without the necessary permissions and simply threw some sort of PermissionException. This would cripple some functionality while preserving the rest. Developers could of course write the apps to not work under such reduced conditions, but Google Play could reject such apps.

matkam 12y ago
Android had a hidden feature in certain iterations of Android 4, called "App Ops," that would let you do this but it never made it to prime time. Though Cyanogenmod does leverage it for their "Privacy Guard" feature.
brk 12y ago
This sounds like a great way for paranoid but uninformed users to break lots of apps, and then blame the developer/phone/carrier (in any random order). We sometimes forget that really with smartphones the manufacturers are trying to produce something for the masses. This would also seem to include reducing the amount of security consciousness the user needs to have in order to have an "acceptable" experience with the device.
- eslaught 12y ago
  And yet, the iPhone basically does this for a number of permissions (location, push notifications, contacts access, etc.), and for the most part it seems to work for even uneducated users of iOS. For most permissions, you might not want this, but for some of the more sensitive and personal-information rich sources, this is a really highly desirable feature.

jbk 12y ago

I wish it was that easy in all cases. For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service). The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work. But on the play store it's written "read phone status and identity" and that's really really scary for the users. And even if we're 100% open source, so people can check the application, and even people recompile VLC, this is a complaint we receive a lot...

aferreira 12y ago
Actually, I don't think you need it. If you can request permission to read the list of activities and do so when your activity is paused, you can search for the phone application (or even similar ones, such as Skype) and pause your audio playback? Just a thought.
- learnstats2 12y ago
  "Check out everything I do with my phone" is one of the permissions I would be more concerned about giving up.
- masklinn 12y ago
  That the phone application is launched does not mean the user is currently in a call, they could be browsing their contacts list.
  - jbk 12y ago
    That too.
  - mcintyre1994 12y ago
    Skype is an even worse example too, I use it for IM more than calls and it presumably stays open for a long time, probably forever on those occasions.

stevebot 12y ago

Just curious though for these specific examples as it says "if you read the source", could these intent's change in future releases, or is it documented outside of the source and accepted that using these intents is not relying on Android internals that could change?

habosa 12y ago

There are two additions to the permissions API that I think would be very helpful: 1) Incremental Authorization - let Android apps ask for permissions only as they need them. So if you never use the phone dialing feature, they never ask for the permission. 2) One-time auth - allow an Android app to do something once. Say, scan your contacts one time. This gives you a little more control, so you know the dev isn't monitoring your phone at 3am. Here is the problem though: most people don't actually care. The vocal minority cares, but most Android users don't know what a permission is if you ask them. So all that developers get for trying to work around permissions is less people using their app or less features in the app. Sadly there is no real incentive for a developer to be sparing with permissions for apps that target the mass market.

Aldo_MX 12y ago
1) Incremental Authorization - let Android apps ask for permissions only as they need them. So if you never use the phone dialing feature, they never ask for the permission. Not only incremental authorization, but the ability of denying specific permissions.
- click170 12y ago
  Take it a step further, I should be able to forge the contacts in my address book, my GPS coordinates, the list of installed apps.. The list goes on. But I would happily start with incremental permissions. Baby steps.
  - 9mit3t2m9h9a 12y ago
    As far as I understand, there is an option that is even simpler for application developers: all applications have the permissions to see and alter whatever they want on the phone, up to a storage quota for modifications. Most of their accesses are hellbanned, though… Hellbanning logic can be altered by applications (obviously, the user would have to allow the configuration application to access the real settings), so granularity can be added as a bolt-on. But I guess giving users actual security and privacy is against both Google's and Apple's interest, so this can only exist on a custom ROM without Google Play Services (or with sandboxed Google Play Services, which is probably against EULA).

ww520 12y ago

This is classic privilege elevation via a 3rd party privileged process. I thought Android's permission system carrying the security context from app to app through Intent. Guess the assumption is wrong. In most OS, the security token/context of the initiating process is carried over to the target process when it's asked to do something on behalf of the initiating process via IPC so that the target process runs at the privilege level of the initiating process even if the target process has a higher privilege to start with.

jonalmeida 12y ago

In the example about the phone call, you could give the user the option to hit the call button, but once this is complete a dialog should popup saying, "Do you want this to happen automagically henceforth?" which would then take full use of the Phone permission. This would also allow permissions to be toggled on/off, which a feature I really want in Android.

tn13 12y ago

I think all apps should be given a choice to have ephimeral permission. For example I dont want someone to find an exploit in my app and steal my user's contacts. I would only take contacts permission when I need and keep it for a short duration and then willingly give it up. User can be explicitly prompted. Also, Camera and Microphones should have only this sort of permissions other than for those which are explictily whitelisted by Google.

swatow 12y ago

This is interesting because it's essentially the same security model as the web. Your app runs in a controlled environment, and it has the option to nest another app (on the web, in an iframe) which it can send messages to, but can't affect the code or UI of. The fact that the UI cannot be manipulated by the nesting app, is crucial, since it allows the security model to tie certain user actions, like pressing dial, to certain actions, like making a phone call.

clumsysmurf 12y ago

In the case of bluetooth, you can either (1) request BLUETOOTH_ADMIN permission and enable BT yourself, or (2) ask Android to show an "Enable Bluetooth Dialog" (BluetoothAdapter.ACTION_REQUEST_ENABLE) which doesn't require that permission. But #2 has been busted for a while https://code.google.com/p/android/issues/detail?id=60002 https://code.google.com/p/android/issues/detail?id=60002 They didn't fix it, and marked it obsolete. So I guess we need BLUETOOTH_ADMIN after all.

robert_tweed 12y ago

> Case in point: android.permission.CALL_PHONE. You need it to initiate phone calls from your app, right? This kind of thing is why I can't see myself switching to Android as my primary mobile OS any time soon. If anything, I can see a bright future for Microsoft. In spite of the fact Windows Phone exists, Android is very much the Windows of the mobile ecosystem. Permissions on Android are horrendous for developers. But they are even worse for users. If a developer can't tell the difference between ACTION_CALL and ACTION_DIAL, what chance does the average end-user have? And when every app requests at least half a dozen permissions, how many users are going to carefully review each and every permission and how many are just going to give up and grant all requested permissions to every app the way that everyone reflexively clicks "agree" to every online ToS? Even if Android actually had a working method to deny individuals permissions, nobody ever has any idea which permissions are essential to which classes of app and which should be treated with suspicion. Compare this to iOS, where you may occasionally get asked to grant an app access to contacts or location - this is a rare occurrence and you can choose deny every time with no negative consequences (except for restricting that functionality). The comment by jbk illustrates just how big a mess permissions on Android are, beyond just being confusing. On top of that you've got custom intents, which while a great idea on paper, just pile more complexity on top of a broken foundation of complexity and obfuscation. This IMO is the single biggest thing wrong with Android, which Google should prioritise fixing like Microsoft in 2002. Never mind signed-app stores like Play: the fundamentally broken security model is the reason why Android is the only mobile platform to have a problem with malware. It's also a brilliant case study in over-engineering with a complete failure to consider human psychology.

pjmlp 12y ago
> If anything, I can see a bright future for Microsoft. I have both Android and Windows Phones. The Windows Phone is actually quite good and from developer point of view, a pleasure compared with Android tooling and APIs. Just the way Microsoft behaved with the customers has made many look elsewhere.
- clumsysmurf 12y ago
  I've been developing for Android since 2009. I also own Windows Phones too. I prefer WP. If WP would achieve just 10% market share in my country, I'd drop Android in a heartbeat. My app deals primarily with Bluetooth BR/EDR + BLE comms to to external devices. Its been nonstop bugginess. Nevermind Wifi Direct, which I can't get working on a good day. I keep hoping the opengarden guys will be able to overcome the crappy Android apis.

blueskin_ 12y ago

This is why I love xprivacy. It gives me a popup when an app tries to access something, and I can whitelist or blacklist it, either on a temporary or permanent basis. Unlike google's halfarsed attempt at a privacy layer, it also doesn't give an exception when an app tries to access restricted data as that can cause apps to crash; it just sends back fake data (device ID is DEFACE, contacts are empty, location is christmas island, etc.). It also covers just about every permission you can think of, unlike app ops/privacy guard that are just a few. Although really, what needs to change isn't just in android itself; it's also developer behaviour. Stop trying to do intrusive things like prefilling forms, as it doesn't benefit the user in any real way.

mcherm 12y ago
> Stop trying to do intrusive things like prefilling forms, as it doesn't benefit the user in any real way. Speak for yourself -- I find prefilled forms to be a time-saver. However, I don't want apps trying to read through my contacts in order to do it. What I want (but haven't actually configured) is xprivacy configured to make contacts appear empty.
- blueskin_ 12y ago
  When an app tries to read your contacts, it gives a popup showing contacts as the item accessed; uncheck 'once' and click deny.

_s 12y ago

Crazy theory but stick with me please - Why aren't we as users allowed to fine grain the data on our device that we want the app to have access to? A benign example would be a camera app; it wants access to my camera and mic, perhaps the local storage. It may have further features to store images in it's cloud service, assign the image to a contact and so forth. But as a user I only want the app for it's picture taking ability - the app requests at the point of installation the permissions it requires, and I only grant it access to the camera. It's then down to the app / developer to handle the exceptions and offer a message saying "You have taken a picture, but the app doesn't have permission to save it to storage. Please allow access by clicking here, otherwise this feature will not work/be unavailable". A bit more of effort on the developers part, no question - but a user than has complete control over what an app can access. I'm not an app developer, but skimming over how intents work and chiming along with this article - I don't think it would be a significant change to the underlying structure of android to hand back specific permission controls to a user.

facepalm 12y ago
I think it is not done that way because it would overwhelm most users. Maybe it could be some kind of expert mode, though. Don't some Android mods (like Cyanogen) allow you to do that?
berkut 12y ago
I guess the app would have to handle not being allowed permission to do these things gracefully. That's possibly a tall order based on my experience with apps these days, although for a difference reason: a lot of them assume there's internet connectivity, which isn't always the case, and a lot of apps don't handle this gracefully at all, even for doing things like opening maps, finding location, turning data off, going to another app, then back to maps again, and it takes ages for it to display because it's expecting to have network access.

snake_plissken 12y ago

I recently got a Moto E as my first smart phone, ever, and after checking out some apps, I was astounded and befuddled by the access permissions that it seems every app needs. Take ESPN's fantasy football app, which requires: device and app history - whats apps are running, browsing history, bookmarks identity - accounts on the device, profile data photo/media/files - access to files on the device and the device's external storage wi-fi connection information - whether wi-fi is enabled, names of connected wi-fi devices device ID and call information - determine the phone number and device IDs, whether a call is active, and the remote number connected by a call I can understand why it might need access to the file system to, for example, upload an avatar. The access to wi-fi seems innocuous, although I would expect something like network connectivity and status to be delegated to a kernel module or background daemon with which an app interfaces. But is there any legitimate (i.e. some non-financial oriented mine as much data as possible) reason it needs to be able to see what other apps are running, my browser history or who is on the other end of a call? There might not be any reason, and ESPN could potentially build the app to have as many or as few permissions as they deem valuable, because people want an app to manage fantasy football teams first. While this example might not be the best, since ESPN is a huge brand and there is no alternative if they are hosting your league, the situation was the same with so many other apps; just absurd permission requirements. None were installed.