4 ms·

This works the same since Android 6 (2015)

by dtech 9y ago

ClassyJacket 9y ago
Only on apps that target Android 6 however. They couldn't retroactively apply it. Just build your app targeting Lollipop and you get all the permissions you want. Plus their app store isn't as strongly vetted, so apps can refuse to work if you don't grant a bullshit tracking permission.
- 0x0 9y ago
  This I never understood. Couldn't they just supply the app with empty lists and black pixels for restricted APIs until the user approved the permission? iOS managed to do this retroactively just fine.
  - ClassyJacket 9y ago
    I believe they do, but you have to specifically go into your settings and explicitly block the permission for the app and click thru a warning that the app might break, rather than ever being asked. I don't remember when iOS did this retroactively, do you have an example? When have they even added a new permission that wasn't a new API entirely?
  - s73ver 9y ago
    I don't think iOS did it retroactively. It's just that, since so many more people actually update (because they're not at the mercy of their carrier), devs update their apps more often.
    - 0x0 9y ago
      I believe you are incorrect. iOS have introduced more and more permissions (most recently, for iOS10 a permission prompt appears for apps trying to access the built-in media library, whereas this was a silent free-for-all in earlier versions), and existing apps are not grandfathered in. According to at least https://www.macrumors.com/2012/06/14/apple-requires-user-permission-before-apps-can-access-personal-data-in-ios-6/ https://www.macrumors.com/2012/06/14/apple-requires-user-per... apps will just receive empty/dummy data until the permission is granted. From my personal experience, camera APIs return black pixels until the permission has been granted, even for apps that were released when iOS 5.0.0 was the latest version and never updated since.
drdaeman 9y ago
It's still broken. First, there is no sane way to grant permissions "just for a few minutes" rather than forever (unless revoked). E.g. a banking app that has a screen with nearest ATM locations doesn't need GPS access granted all the time - only when I ask for the directions. Then, there are apps that ask for just about everything (a long sequence of "grant AppName access to something") at startup. It's a subjective opinion but I believe this sort of "fix" to deal with the new permission model on SDK update was quite popular, as I saw it relatively a lot. And it's good if denying access is an option and you just aren't asked the same thing again until you either give up or kill the app. It's probably not an issue if that's some flashlight app you can uninstall without even thinking about it, but isn't so much when it's an app from your mobile network, allowing you to manage your plan, or something unique enough to be considered valuable. I see only two options how to fix this for real. First is more and more regulations. Second is improved app isolation and permission spoofing (silent mic input, empty contact list and filesystem, no persistent identifiers across reinstalls, etc), and activity indicators "app is trying to access the camera right now", "app had accessed your contact list recently" that would both raise alarm or allow to grant access, depending on the end-user decision.
obsurveyor 9y ago
Google doesn't even apply the permissions very tightly. App makers are happy to ignore recommendations(I don't think they're requirements) to work, even if not granted the permission. They just do things like prompt over and over or completely stop working if they detect they're given the fake, default data from not being given permission to things like your Contacts or Location. There's no user agency in Android 6.0+ permissions really, the apps can just hold their functionality over the users' head until they accede. Also, Android permissions are strange. Like, why does an app need access to Contacts to use my Google Account to sign in? An account is not a contact and just because I want to let you unify my logins, that doesn't mean I want you to have access to my contacts.
- chickenbane 9y ago
  Obviously the first problem is most users (almost 2/3) aren't using M+. However, that being said I do want to clear up some of your points about user agency. It is true app makers are happy to ignore recommendations, but users with M+ are much more empowered. So, for example, if the app makes permission requests repeatedly, on the 2nd ask Android will provide the "Never ask again" check to auto deny permission requests. So if an app is being annoying about a permission you (the Android user) don't want to give you can silence the app. Also, you can always deny individual permissions after you've granted them, which also includes apps that don't target M+. So if you don't think an app should require the Contacts permission then you can deny only that permission. You can argue that this is a "power user" feature, but if you're interested in app permissions I think M+ gives you the appropriate levers. And surprisingly, I've seen the developers who fix their app if enough users uninstall it and leaving a review citing poor permissions.
  - obsurveyor 9y ago
    I forgot about the "Never ask again" functionality, that is definitely good for user agency but it would be much better if Google required apps on the Play store to function with real data or fake data. This includes having an alternate auth method if the user doesn't grant access to their account, especially in light of the following paragraph. However, you don't really address my concern that Contacts is grouped up with Accounts when it shouldn't be. I cannot deny an app access to my contacts while allowing it to use my account to sign in. Android app permissions need to become much more granular and fully backwards compatible. Ironically, I'm sitting here not upgrading my phone to Nougat because I really dislike the material design aesthetic of the UI. It's ugly, blinding white and turns every icon into boring circles. It also apparently breaks a lot of stuff that I use everyday.

This works the same since Android 6 (2015)

by dtech 9y ago

This works the same since Android 6 (2015)

Only on apps that target Android 6 however. They couldn't retroactively apply it. Just build your app targeting Lollipop and you get all the permissions you want. Plus their app store isn't as strongly vetted, so apps can refuse to work if you don't grant a bullshit tracking permission.

0x0 9y ago
This I never understood. Couldn't they just supply the app with empty lists and black pixels for restricted APIs until the user approved the permission? iOS managed to do this retroactively just fine.
- ClassyJacket 9y ago
  I believe they do, but you have to specifically go into your settings and explicitly block the permission for the app and click thru a warning that the app might break, rather than ever being asked. I don't remember when iOS did this retroactively, do you have an example? When have they even added a new permission that wasn't a new API entirely?
- s73ver 9y ago
  I don't think iOS did it retroactively. It's just that, since so many more people actually update (because they're not at the mercy of their carrier), devs update their apps more often.
  - 0x0 9y ago
    I believe you are incorrect. iOS have introduced more and more permissions (most recently, for iOS10 a permission prompt appears for apps trying to access the built-in media library, whereas this was a silent free-for-all in earlier versions), and existing apps are not grandfathered in. According to at least https://www.macrumors.com/2012/06/14/apple-requires-user-permission-before-apps-can-access-personal-data-in-ios-6/ https://www.macrumors.com/2012/06/14/apple-requires-user-per... apps will just receive empty/dummy data until the permission is granted. From my personal experience, camera APIs return black pixels until the permission has been granted, even for apps that were released when iOS 5.0.0 was the latest version and never updated since.

drdaeman 9y ago

It's still broken. First, there is no sane way to grant permissions "just for a few minutes" rather than forever (unless revoked). E.g. a banking app that has a screen with nearest ATM locations doesn't need GPS access granted all the time - only when I ask for the directions. Then, there are apps that ask for just about everything (a long sequence of "grant AppName access to something") at startup. It's a subjective opinion but I believe this sort of "fix" to deal with the new permission model on SDK update was quite popular, as I saw it relatively a lot. And it's good if denying access is an option and you just aren't asked the same thing again until you either give up or kill the app. It's probably not an issue if that's some flashlight app you can uninstall without even thinking about it, but isn't so much when it's an app from your mobile network, allowing you to manage your plan, or something unique enough to be considered valuable. I see only two options how to fix this for real. First is more and more regulations. Second is improved app isolation and permission spoofing (silent mic input, empty contact list and filesystem, no persistent identifiers across reinstalls, etc), and activity indicators "app is trying to access the camera right now", "app had accessed your contact list recently" that would both raise alarm or allow to grant access, depending on the end-user decision.

obsurveyor 9y ago

Google doesn't even apply the permissions very tightly. App makers are happy to ignore recommendations(I don't think they're requirements) to work, even if not granted the permission. They just do things like prompt over and over or completely stop working if they detect they're given the fake, default data from not being given permission to things like your Contacts or Location. There's no user agency in Android 6.0+ permissions really, the apps can just hold their functionality over the users' head until they accede. Also, Android permissions are strange. Like, why does an app need access to Contacts to use my Google Account to sign in? An account is not a contact and just because I want to let you unify my logins, that doesn't mean I want you to have access to my contacts.

chickenbane 9y ago
Obviously the first problem is most users (almost 2/3) aren't using M+. However, that being said I do want to clear up some of your points about user agency. It is true app makers are happy to ignore recommendations, but users with M+ are much more empowered. So, for example, if the app makes permission requests repeatedly, on the 2nd ask Android will provide the "Never ask again" check to auto deny permission requests. So if an app is being annoying about a permission you (the Android user) don't want to give you can silence the app. Also, you can always deny individual permissions after you've granted them, which also includes apps that don't target M+. So if you don't think an app should require the Contacts permission then you can deny only that permission. You can argue that this is a "power user" feature, but if you're interested in app permissions I think M+ gives you the appropriate levers. And surprisingly, I've seen the developers who fix their app if enough users uninstall it and leaving a review citing poor permissions.
- obsurveyor 9y ago
  I forgot about the "Never ask again" functionality, that is definitely good for user agency but it would be much better if Google required apps on the Play store to function with real data or fake data. This includes having an alternate auth method if the user doesn't grant access to their account, especially in light of the following paragraph. However, you don't really address my concern that Contacts is grouped up with Accounts when it shouldn't be. I cannot deny an app access to my contacts while allowing it to use my account to sign in. Android app permissions need to become much more granular and fully backwards compatible. Ironically, I'm sitting here not upgrading my phone to Nougat because I really dislike the material design aesthetic of the UI. It's ugly, blinding white and turns every icon into boring circles. It also apparently breaks a lot of stuff that I use everyday.