6 ms·

> To better ensure privacy, Android P restricts access to mic, camera, and all SensorManager sensors from apps that are idle. Good. Now, if only permissions co

> To better ensure privacy, Android P restricts access to mic, camera, and all SensorManager sensors from apps that are idle. Good. Now, if only permissions could be granted temporarily (e.g. "allow for this session", which auto-revokes after 5-60 minutes of not using the application), it'll be perfect. > We will also enable encryption of Android backups with a client-side secret. Is this about BackupManager? Awesome if so. (BTW, have anyone ever heard of any alternative BackupTransports, besides Google Drive?) > Android P also gives the user control over access to the platform's build.serial identifier by putting it behind the READ_PHONE_STATE permission. IMHO, they should've really split that in two different permissions and deprecate READ_PHONE_STATE. Device identifiers (including SIM card identities) and phone state ("someone's calling") are two different things.

dblohm7 9y ago
I'd like to see baseline Android block clipboard access from background apps a la Copperhead OS.
- zanedb 9y ago
  How about requesting clipboard access in the first place?
eco 9y ago
> Now, if only permissions could be granted temporarily This flow would be much nicer but you can go in and revoke a permission later in App Permissions (not sure how many people know this).
- drdaeman 9y ago
  I know. This is what I do every time there's an app that needs accidental one-time camera or GPS access, but not a trustworthy enough to be granted those permanently. Like a banking app that can show me nearby ATMs when I need one (but then I don't want to even theoretically permit my bank to obtain my location outside of this scenario). Not convenient, as it requires a) not forgetting to revoke when done and b) a series of taps.
  - JoshTriplett 9y ago
    > Like a banking app that can show me nearby ATMs when I need one Android needs an intent for "get current location" rather than "always have access to location". Apps don't need camera permission to let the user capture one image from the camera, only to autonomously control the camera themselves. Similarly, an Android app should have the ability to request one current location fix, for this kind of purpose, and have that trigger an interactive request with a map. (That also makes it easy to do "look for ATMs near where I'm going to be this afternoon".) Better yet, the app could expose a "points of interest" interface, and then Google Maps or another maps app could make those points of interest available.
    - on_and_off 9y ago
      Great idea ! You would not even need any change to the OS itself, just a new intent implemented by all locations apps.
maxxxxx 9y ago
"Good. Now, if only permissions could be granted temporarily (e.g. "allow for this session", which auto-revokes after 5-60 minutes of not using the application), it'll be perfect." This would be nice.
- squiggleblaz 9y ago
  Yes. There's so many apps that want to manage my SMSes just so they can authorise. It's a nice and convenient feature, but they only need to authorise once. Why should they have permission to manage my SMSes for days and weeks and years afterwards? Short-term permission would be nice, and should be the default. If the app needs the permission for a second session, then it should potentially receive it permanently.
  - nazark 9y ago
    There is API specifically for that - https://developer.android.com/reference/android/telephony/SmsManager.html#createAppSpecificSmsToken(android.app.PendingIntent) https://developer.android.com/reference/android/telephony/Sm...
    - itp 9y ago
      I'm torn about this. Every time an app has used this API, it's been a delight. And yet I hesitate to encourage more people to use SMS as auth!
      - srinathrajaram 9y ago
        This is available only on Android O and the adoption is not encouraging. Hopefully, P will have a much better uptake.
ehsankia 9y ago
I'm curious, does anyone have a list of apps that would have legitimate use of sensor data in the background?
- jvolkman 9y ago
  What about a baby monitor app? Is the app considered backgrounded when the screen is off?
  - 9034725985 9y ago
    I was hoping we could use old phones as IP cameras with the screen turned off. I hope apps that are last in the foreground can continue to access camera and microphone and sensors with the screen turned off -- at least when connected to power.
- simlevesque 9y ago
  Fitness apps.
  - AstralStorm 9y ago
    Yup, these will now have to run a foreground service or be part of the platform.
- agildehaus 9y ago
  I recently wrote an Android Wear app for someone who wanted sensor data recorded in the background for legitimate medical research. I would assume upgrading to P will break that app.
  - dlhavema 9y ago
    Prolly not for wear apps. Those are all about biometric data collection...
- traek 9y ago
  Quantified self apps e.g. Human, Moves.
daveguy 9y ago
Does restricting access to the mic from idle programs also conveniently prevent any competition to Google Assistant? That's kind of unsettling because it seems Google is doing a lot of data collection through their home speakers. An anecdote: I got a little creeped out at assistant / home and disabled all the tracking. Almost immediately my Android phone started harassing me to turn permissions back on through my phone. And Google Home refused to do anything with tracking off. It responded to all wake prompts with "you need to change settings".
- blinkingled 9y ago
  I'm sure this being Android you'll be able to whitelist apps to allow background data collection. You'll just need to find the right setting.
- bastawhiz 9y ago
  Hotword detection has been a private API since it was introduced. You can't use it unless your app is signed by Google. Android P doesn't seem to change this at all.
- on_and_off 9y ago
  Not really, you will just need a foreground service, which you would have needed anyway. Google has been pretty fair as far as Android APIs go, even the API analyzing your current view hierarchy is open to anybody to implement (IIRC there is of course a big permission dialog to show before allowing an app to use it)
jm_l 9y ago
FYI, what you're calling phone state (someone's calling) is actually call state (https://developer.android.com/reference/android/telephony/TelephonyManager.html#getCallState() https://developer.android.com/reference/android/telephony/Te...) which does not require READ_PHONE_STATE. That permission seems mostly used for things like protecting SIM card identities.

dblohm7 9y ago

I'd like to see baseline Android block clipboard access from background apps a la Copperhead OS.

zanedb 9y ago
How about requesting clipboard access in the first place?

eco 9y ago

> Now, if only permissions could be granted temporarily This flow would be much nicer but you can go in and revoke a permission later in App Permissions (not sure how many people know this).

drdaeman 9y ago
I know. This is what I do every time there's an app that needs accidental one-time camera or GPS access, but not a trustworthy enough to be granted those permanently. Like a banking app that can show me nearby ATMs when I need one (but then I don't want to even theoretically permit my bank to obtain my location outside of this scenario). Not convenient, as it requires a) not forgetting to revoke when done and b) a series of taps.
- JoshTriplett 9y ago
  > Like a banking app that can show me nearby ATMs when I need one Android needs an intent for "get current location" rather than "always have access to location". Apps don't need camera permission to let the user capture one image from the camera, only to autonomously control the camera themselves. Similarly, an Android app should have the ability to request one current location fix, for this kind of purpose, and have that trigger an interactive request with a map. (That also makes it easy to do "look for ATMs near where I'm going to be this afternoon".) Better yet, the app could expose a "points of interest" interface, and then Google Maps or another maps app could make those points of interest available.
  - on_and_off 9y ago
    Great idea ! You would not even need any change to the OS itself, just a new intent implemented by all locations apps.

maxxxxx 9y ago

"Good. Now, if only permissions could be granted temporarily (e.g. "allow for this session", which auto-revokes after 5-60 minutes of not using the application), it'll be perfect." This would be nice.

squiggleblaz 9y ago
Yes. There's so many apps that want to manage my SMSes just so they can authorise. It's a nice and convenient feature, but they only need to authorise once. Why should they have permission to manage my SMSes for days and weeks and years afterwards? Short-term permission would be nice, and should be the default. If the app needs the permission for a second session, then it should potentially receive it permanently.
- nazark 9y ago
  There is API specifically for that - https://developer.android.com/reference/android/telephony/SmsManager.html#createAppSpecificSmsToken(android.app.PendingIntent) https://developer.android.com/reference/android/telephony/Sm...
  - itp 9y ago
    I'm torn about this. Every time an app has used this API, it's been a delight. And yet I hesitate to encourage more people to use SMS as auth!
    - srinathrajaram 9y ago
      This is available only on Android O and the adoption is not encouraging. Hopefully, P will have a much better uptake.

ehsankia 9y ago

I'm curious, does anyone have a list of apps that would have legitimate use of sensor data in the background?

jvolkman 9y ago
What about a baby monitor app? Is the app considered backgrounded when the screen is off?
- 9034725985 9y ago
  I was hoping we could use old phones as IP cameras with the screen turned off. I hope apps that are last in the foreground can continue to access camera and microphone and sensors with the screen turned off -- at least when connected to power.
simlevesque 9y ago
Fitness apps.
- AstralStorm 9y ago
  Yup, these will now have to run a foreground service or be part of the platform.
agildehaus 9y ago
I recently wrote an Android Wear app for someone who wanted sensor data recorded in the background for legitimate medical research. I would assume upgrading to P will break that app.
- dlhavema 9y ago
  Prolly not for wear apps. Those are all about biometric data collection...
traek 9y ago
Quantified self apps e.g. Human, Moves.

daveguy 9y ago

Does restricting access to the mic from idle programs also conveniently prevent any competition to Google Assistant? That's kind of unsettling because it seems Google is doing a lot of data collection through their home speakers. An anecdote: I got a little creeped out at assistant / home and disabled all the tracking. Almost immediately my Android phone started harassing me to turn permissions back on through my phone. And Google Home refused to do anything with tracking off. It responded to all wake prompts with "you need to change settings".

blinkingled 9y ago
I'm sure this being Android you'll be able to whitelist apps to allow background data collection. You'll just need to find the right setting.
bastawhiz 9y ago
Hotword detection has been a private API since it was introduced. You can't use it unless your app is signed by Google. Android P doesn't seem to change this at all.
on_and_off 9y ago
Not really, you will just need a foreground service, which you would have needed anyway. Google has been pretty fair as far as Android APIs go, even the API analyzing your current view hierarchy is open to anybody to implement (IIRC there is of course a big permission dialog to show before allowing an app to use it)

jm_l 9y ago

FYI, what you're calling phone state (someone's calling) is actually call state (https://developer.android.com/reference/android/telephony/TelephonyManager.html#getCallState() https://developer.android.com/reference/android/telephony/Te...) which does not require READ_PHONE_STATE. That permission seems mostly used for things like protecting SIM card identities.