8 ms·

Has anyone noticed apps switching from requesting individual permissions to relying on Google Services permissions lately? For instance, Google Maps now need Go

Has anyone noticed apps switching from requesting individual permissions to relying on Google Services permissions lately? For instance, Google Maps now need Google Services to have permissions to [1]. This makes it even harder to track which information apps are actually collecting (in case you grant all permissions to Google Services). [1] http://i63.tinypic.com/1zwt91.jpg http://i63.tinypic.com/1zwt91.jpg

sha666sum 10y ago
Slightly tangential, but yesterday my Gmail app kindly informed me that I need to give Google Play Services the following permissions in order for it to function: - Body Sensors - Calendar - Camera - Contacts - Location - Microphone - Phone - SMS - Storage This promptly led me to discover K-9 Mail. Not entirely incidentally, Google's Calendar was so helpful as to suggest that I install Google's fitness tracker to integrate with the Calendar. I politely declined the offer, and installed Etar.
- vmateixeira 10y ago
  That's exactly what I mean.
  - sha666sum 10y ago
    I misread your post in haste, sorry.
    - vmateixeira 10y ago
      No worries :) Any ideas on why are apps swapping to this permission model?
      - sha666sum 10y ago
        So that I don't make unfounded claims I had to do a bit of research on the Android app permission model. Source: https://developers.google.com/android/guides/permissions https://developers.google.com/android/guides/permissions > Google Play services automatically obtains all permissions it needs to support its APIs--your app won't normally need to request permissions to use them. However, your app should still check and request runtime permissions as necessary and appropriately handle errors in cases where a user has denied Google Play services a permission required for an API your app uses. I'd say this constitutes a loophole in the Android app permission model and Google as well as other app developers have a mutual interest in using it so that their apps get as many permissions as possible. It has practical benefits too, though: querying Google Play services for your location info, rather than independently looking it up, saves battery life. Google certainly has financial interest in it - their position in the middle gives them analytics data and keeps developers dependent on Google API's. I don't think there are many F-Droid apps that are dependent on Google Play services. It's likely also easier for the developer to use Google's API rather than provide their own implementation, which is of course what Google wants. It just comes at the expense of the user. I suppose the solution is to tighten the app security model, at least on an opt-in level, as I can't imagine the average user being interested in being queried for even more permissions. I think apps should require permission to interact with other apps (such as Google Play services), and most of all they should require permission to access the internet. I can't imagine Google championing this cause, though.
        vmateixeira 10y ago
        Thanks for your elaborated response :) I had understood how it could be placed according to their business model but wasn't considering benefits for their phone's OS ecosystem (battery saving) which is also clearly important. I don't like this coming at users expence though. People don't actually know what they're sharing and there seems to be no concern and will about informing them in a practical and functional way. We already know that EULAs, Disclaimers, etc are broken as they miss their main target: informing clearly the common individual. It's a shame companies are continuing to explore this more and more. I can also foresee this app security model ending up a big mess if we consider mantaining old android versions app permissions model compatibilities plus all of what it is becoming.
- ade2 10y ago
  Looks like it's a bug https://productforums.google.com/forum/#!topic/gmail/oTMPWq2u5H4 https://productforums.google.com/forum/#!topic/gmail/oTMPWq2...
  - vmateixeira 10y ago
    I just started noticing this recently whereas that "bug report" dates from last year.
  - TeMPOraL 10y ago
    These days it's harder to tell whether something was a bug, or only became a bug after it was discovered.
ade2 10y ago
What do you mean? Do you have an example? Is this some kind of work-around?
- vmateixeira 10y ago
  No, it's just that I noticed something weird with some apps. For instance, Google Maps is now relying on Google Services permissions instead of asking for permissions for itself [1]. If I'll give these permissions to Google Services, it means any app also using Google Services will automatically have access to the allowed resources. [1] http://i63.tinypic.com/1zwt91.jpg http://i63.tinypic.com/1zwt91.jpg
  - reddiric 10y ago
    I've noticed this just starting to happen to me much more aggressively in the last few days. Now the Gmail app will pop up that same modal box in your screenshot every time I make the Gmail app have focus (from the home screen or from the square-button-menu), and every time I open any email. None of the Google apps respect me. The maps app makes me disagree to giving enhanced location tracking every time I turn on location. The music player has a big bar constantly at the top that says "Downloaded Only," which if I accidentally tap it turns off downloaded only mode and kicks me to the store. If I leave location on accidentally, the camera app will sometimes use location to guess where I took a picture and ask me to "share" that. I don't use Google search, but I can't remove the giant search bar from the main screen or the shortcut if I accidentally hold the menu button. Those are the only Google apps I use, and they all disrespect me. I only use a bit of Google but it's exhausting to even use just that bit.
    - vmateixeira 10y ago
      Yes, just gave Google Maps as an example but I'm experiencing the same with Gmail and others. It's starting to become very annoying. My biggest concern is, even if I trust Google Services to have access to all of those requested permissions (consequently allowing the designated app Gmail, Maps, etc to access them) will these resources (permissions granted) be available to any app using Google Services?
codeka 10y ago
Google Play Services won't give an app any more than that app has permissions for. If you request location updates from Google Play Services, for example, but your app doesn't have the fine-location permission, you won't get GPS locations.
- vmateixeira 10y ago
  Alright, thanks for your input. Any ideas on why is this happening?
  - BoorishBears 10y ago
    Because Google is trying to further consolidate/integrate Android and Google Play Services since they can update the latter a lot easier than they can update the former (gets around issues like carrier approval). More and more core features need features from Google Play Services and Firebase, and it's only getting worse.
    - vmateixeira 10y ago
      That's actually a very good reason altough I can foresee this getting messier if we consider backwards compatibility.
      - BoorishBears 10y ago
        It's a good reason but bad news for Android staying useful in it's open source incarnations since Google keeps Google Play Services on a tight leash
Vinnl 10y ago
Yeah, I use XPrivacy, but this makes it really hard to know which things I should allow and which I shouldn't...
- autoreleasepool 10y ago
  Agreed. It's there so I feel informed but at the same time I feel I need to allow practically everything in order to not break the app.
taneq 10y ago
Yes, and I hate it, to the point where I'm now running Cyanogen. They finally got fine-grained permissions right and then promptly jammed in this backdoor so that they keep their fangs in every aspect of your data. (You can control what data is sent to everyone else, mind. Just not what they get.)

sha666sum 10y ago

Slightly tangential, but yesterday my Gmail app kindly informed me that I need to give Google Play Services the following permissions in order for it to function: - Body Sensors - Calendar - Camera - Contacts - Location - Microphone - Phone - SMS - Storage This promptly led me to discover K-9 Mail. Not entirely incidentally, Google's Calendar was so helpful as to suggest that I install Google's fitness tracker to integrate with the Calendar. I politely declined the offer, and installed Etar.

vmateixeira 10y ago
That's exactly what I mean.
- sha666sum 10y ago
  I misread your post in haste, sorry.
  - vmateixeira 10y ago
    No worries :) Any ideas on why are apps swapping to this permission model?
    - sha666sum 10y ago
      So that I don't make unfounded claims I had to do a bit of research on the Android app permission model. Source: https://developers.google.com/android/guides/permissions https://developers.google.com/android/guides/permissions > Google Play services automatically obtains all permissions it needs to support its APIs--your app won't normally need to request permissions to use them. However, your app should still check and request runtime permissions as necessary and appropriately handle errors in cases where a user has denied Google Play services a permission required for an API your app uses. I'd say this constitutes a loophole in the Android app permission model and Google as well as other app developers have a mutual interest in using it so that their apps get as many permissions as possible. It has practical benefits too, though: querying Google Play services for your location info, rather than independently looking it up, saves battery life. Google certainly has financial interest in it - their position in the middle gives them analytics data and keeps developers dependent on Google API's. I don't think there are many F-Droid apps that are dependent on Google Play services. It's likely also easier for the developer to use Google's API rather than provide their own implementation, which is of course what Google wants. It just comes at the expense of the user. I suppose the solution is to tighten the app security model, at least on an opt-in level, as I can't imagine the average user being interested in being queried for even more permissions. I think apps should require permission to interact with other apps (such as Google Play services), and most of all they should require permission to access the internet. I can't imagine Google championing this cause, though.
      - vmateixeira 10y ago
        Thanks for your elaborated response :) I had understood how it could be placed according to their business model but wasn't considering benefits for their phone's OS ecosystem (battery saving) which is also clearly important. I don't like this coming at users expence though. People don't actually know what they're sharing and there seems to be no concern and will about informing them in a practical and functional way. We already know that EULAs, Disclaimers, etc are broken as they miss their main target: informing clearly the common individual. It's a shame companies are continuing to explore this more and more. I can also foresee this app security model ending up a big mess if we consider mantaining old android versions app permissions model compatibilities plus all of what it is becoming.
ade2 10y ago
Looks like it's a bug https://productforums.google.com/forum/#!topic/gmail/oTMPWq2u5H4 https://productforums.google.com/forum/#!topic/gmail/oTMPWq2...
- vmateixeira 10y ago
  I just started noticing this recently whereas that "bug report" dates from last year.
- TeMPOraL 10y ago
  These days it's harder to tell whether something was a bug, or only became a bug after it was discovered.

ade2 10y ago

What do you mean? Do you have an example? Is this some kind of work-around?

vmateixeira 10y ago
No, it's just that I noticed something weird with some apps. For instance, Google Maps is now relying on Google Services permissions instead of asking for permissions for itself [1]. If I'll give these permissions to Google Services, it means any app also using Google Services will automatically have access to the allowed resources. [1] http://i63.tinypic.com/1zwt91.jpg http://i63.tinypic.com/1zwt91.jpg
- reddiric 10y ago
  I've noticed this just starting to happen to me much more aggressively in the last few days. Now the Gmail app will pop up that same modal box in your screenshot every time I make the Gmail app have focus (from the home screen or from the square-button-menu), and every time I open any email. None of the Google apps respect me. The maps app makes me disagree to giving enhanced location tracking every time I turn on location. The music player has a big bar constantly at the top that says "Downloaded Only," which if I accidentally tap it turns off downloaded only mode and kicks me to the store. If I leave location on accidentally, the camera app will sometimes use location to guess where I took a picture and ask me to "share" that. I don't use Google search, but I can't remove the giant search bar from the main screen or the shortcut if I accidentally hold the menu button. Those are the only Google apps I use, and they all disrespect me. I only use a bit of Google but it's exhausting to even use just that bit.
  - vmateixeira 10y ago
    Yes, just gave Google Maps as an example but I'm experiencing the same with Gmail and others. It's starting to become very annoying. My biggest concern is, even if I trust Google Services to have access to all of those requested permissions (consequently allowing the designated app Gmail, Maps, etc to access them) will these resources (permissions granted) be available to any app using Google Services?

codeka 10y ago

Google Play Services won't give an app any more than that app has permissions for. If you request location updates from Google Play Services, for example, but your app doesn't have the fine-location permission, you won't get GPS locations.

vmateixeira 10y ago
Alright, thanks for your input. Any ideas on why is this happening?
- BoorishBears 10y ago
  Because Google is trying to further consolidate/integrate Android and Google Play Services since they can update the latter a lot easier than they can update the former (gets around issues like carrier approval). More and more core features need features from Google Play Services and Firebase, and it's only getting worse.
  - vmateixeira 10y ago
    That's actually a very good reason altough I can foresee this getting messier if we consider backwards compatibility.
    - BoorishBears 10y ago
      It's a good reason but bad news for Android staying useful in it's open source incarnations since Google keeps Google Play Services on a tight leash

Vinnl 10y ago

Yeah, I use XPrivacy, but this makes it really hard to know which things I should allow and which I shouldn't...

autoreleasepool 10y ago
Agreed. It's there so I feel informed but at the same time I feel I need to allow practically everything in order to not break the app.

taneq 10y ago

Yes, and I hate it, to the point where I'm now running Cyanogen. They finally got fine-grained permissions right and then promptly jammed in this backdoor so that they keep their fangs in every aspect of your data. (You can control what data is sent to everyone else, mind. Just not what they get.)