8 ms·

Google must be sweating bullets right now. Every single Android app seems to require access to every single thing, and there are hundreds of thousands of them w

Google must be sweating bullets right now. Every single Android app seems to require access to every single thing, and there are hundreds of thousands of them with a significant user base. Some do most certainly misuse the data they collect. Maybe a small percentage, but a small percentage of 100k is still a large number.

leggomylibro 9y ago
Google is in a bit of a different position. The most information that a malicious app on my friend's phone can access about me is what my friend has stored on their phone about me. Personal things like messaging history and contact information are certainly enough to build a 'social graph', but what Google does not let apps do is access the information that Google stores about me on their servers just because my friend has both my number and a greedy app on their phone.
- aylmao 9y ago
  Different, but not better IMO, since Facebook solved the friend access problem in 2014 but Google apps still have this issue today. Moreover, Facebook can push updates instantly since it's a web API-- I hope Google has some way of changing this without requiring a full OS update. Also worth considering, Facebook is all about social and preference ("like") data, but live location is something you can get as a mobile app and a lot of stuff can be inferred from where you live/work/visit.
- trendia 9y ago
  CA was able to extract a personality profile from just likes. Imagine what an app could do if they had access to your entire message history! (Why would anyone give apps access to their messages? So that they can send / receive special emoji, for example.)
  - leggomylibro 9y ago
    Well, messaging history is just an example; I'm not actually sure if that is something which apps are allowed to lift, but I figured I'd err on the extreme end. Either way, discrete and easy-to-digest information like 'likes' are exactly what they wouldn't have access to from Google, and honestly it seems like automated sentiment analyses are still very error-prone; large corpuses of text don't seem ideal for this sort of targeting.
  - criley2 9y ago
    So these days Facebook requires you to sign a contract to get any significant data or permission any more. I don't think Google does that...
    - deleted 9y ago
      [deleted]
  - skybrian 9y ago
    Graphs that connect users are not all the same. For example, it's much more common to follow relatives and people you know in real life on Facebook than on Twitter. (This is one of the reasons Google tried to build Google+: they were worried that not having a real social network would put them at a disadvantage.) It's all privacy leakage but it's not at all the same data. Facebook's graph is still noisy but it's better or at least different data than other companies have.
  - Waterluvian 9y ago
    Was the personality profile any good? Otherwise I could make that claim about extracting a personality profile out of tea leaves.
  - diyseguy 9y ago
    Seems to me they could make more fine grained permissions. E.g., I don't like that my javascript disabler Firefox plugin has permissions to 'Access data for all websites', 'Access browser tabs'.
- cwkoss 9y ago
  Can't apps view list of contacts?
  - izacus 9y ago
    Not without explicit user permission, no.
- mtgx 9y ago
  They could extract pictures. In the future, once more devices have AI chips on board and maybe there's an API for seeing what's in the pictures, too, with ML, I could see developers abuse that, and extract all sorts of relevant info from people's phones. Regardless of how dangerous Android permissions are or aren't, I do agree with the larger point that Google is scared about what will happen to Facebook, because it knows those regulations or even a "privacy revolution" that may come in the wake of this will impact it, too. It's probably not even just this one event that will hurt Google. This sentiment has been growing over the past few years. If Google hasn't noticed it growing, then they are out of touch. If the anti-privacy trend continues, it will be bad news for Google, Amazon, Microsoft, and even Apple (which seems to be backtracking on some privacy features lately). I do hope that at the very least the anti-privacy trend pushes companies to limit data gathering and use new privacy-preserving tech that doesn't allow them to look at the data at all. And I hope they do that before it's too late (for them).
- throwaway84742 9y ago
  >> does not let apps do is access the information Neither does FB I believe. Otherwise their business model of knowing more about you than anybody else would fall apart.
  - untog 9y ago
    The whole recent scandal is based around the fact that the FB API does allow apps to download all kinds of user information, and used to let them download data about their friends.
    - throwaway84742 9y ago
      Not “all kinds”. Users routinely approve the use of their friends list, and in this case, this is what was downloaded and data mined, in addition to user’s own profile information. I know this is too much nuance for a lay person to handle, but I expect more from HN readers. The scummy part was that the data was obtained using an app that’s unrelated to what the data was eventually used for, but Android is totally ripe for that as well.
      - untog 9y ago
        "all kinds" isn't exactly a scientifically defined term. Friends list an "profile information" is still very broad. The additional scummy part was that you could authorize FB to download that data for your friends as well as yourself, so your data might be consumed without you ever being aware of, or giving permission for it. As far as I'm aware Android has no such equivalent.
        throwaway84742 9y ago
        >> could authorize FB to download that data for your friends I don’t believe this is true. You could authorize apps to download a very limited amount of info about your friends. If you have a reference to some authoritative source that proves the opposite, do share. Extraordinary claims demand extraordinary evidence, and all that.
- canoebuilder 9y ago
  the information that Google stores about me on their servers I've not seen anyone address this, but reading between the lines, many people seem to hold a view that the existence of these finely-grained personal data profiles at this massive scale is fine so long as they exist only on the servers of fb and goog, but why? What makes that acceptable or reasonable, besides the persuasiveness of large amounts of money? I think the clearest path forward is that no one should be creating these kinds of data profiles. I don't think a bot learning my route to work, or a doctor's appt(along with a swath of more "monetizable" personal info) so it can alert me to potential traffic delays is a reasonable trade-off for the massive societal problems the behaviour of creating these data profiles poses. If this data is such a monumental danger when it escapes the permeable confines of the fbs and the googs, then it shouldn't exist within these companies either, not just because as we've seen the confines are quite permeable, but also because the potential for negative use of the data doesn't change depending on who has access to it. It can be persuasively argued that simply creating and collecting these data profiles is itself a negative use of the data.
  - skybrian 9y ago
    It might not be okay but it is different. At least in a technical discussion, we should be able to make distinctions rather than treating all data or all breaches the same.
  - leggomylibro 9y ago
    I don't think it's acceptable, I just realize that I am powerless to stop it beyond supporting sweeping new regulatory frameworks, which I write to my Congresspeople about but what do you think they're going to do about it? Nothing. And for now, Google's services are worth the data they collect. Facebook's value proposition is comparatively laughable, which might be why so many people are so upset with the scope of how their data was used. And don't even get me started on how users, including those who have not signed up for the service, get tracked on massive swaths of 3rd-party sites if they don't take pains to prevent it - that's downright sinister.
- calvinbhai 9y ago
  I'm not an Android user, but I feel there's way more data accessible on Android for app developers than many people realize. Photos (on Android and iOS) contain a wealth of information, and any app having access to photos, can clearly figure out where you have been (based on photo's metadata containing GPS location), what you like to eat (if you take a lot of photos of food), where you like to hangout, time of day/week you do certain activities, purely based on image recognition. Any wonder why Google Lens is integrated in the Google Photos app? Add to that, the ability of identifying people from photos (Apple, Facebook and Google do it very well) and you can easily connect the dots, and it'll be hard to escape this kind of data digging, even if you are Jack Reacher. Even pro-privacy Apple doesn't do much in terms of access to photos on iOS. If I want to share one image on Whatsapp on iOS, I have to give Whatsapp access to Photo Album. And once the access is given, a superficial scan can provide WhatsApp full info of locations from my photos, in a few seconds (even if it is 20 GB of photos). Privacy on iOS in this aspect is bad. I can only imagine that Android is much worse.
  - izacus 9y ago
    That's simply not true. Apps aren't allowed to access photos without permission on modern Android (6.0+) and you don't need to grant the app full access to photo album just to share an image. Androids intent system always handled these use cases better than iOS did.
guelo 9y ago
Google might know a lot about you but they have never exposed that to third party apps. Facebook's data is much more personal. With a user's "Like" stream it's possible to build a surprisingly accurate personality profile. The worst Android offenders, as always, are the big ad libraries that are installed across a lot of apps. They're able to build a rough personality profile based on the types of apps someone has installed. So they can generally say if a user is into categories like music or politics or comedy. But that problem exists on iOS and the web. Android has also tightened up its permission model considerably over the last several years.
- jlarocco 9y ago
  > Google might know a lot about you but they have never exposed that to third party apps. How do you know that?
- prepend 9y ago
  Remember the 2013 Snowden leaks? Google doesn’t have to knowingly expose their info on you, it may happen against their will. Or unknown to them. Even if Google is an altruistic organization, it’s dangerous to have that profile data remote. I hope that local computing can get strong enough to do the same types of assistant type usefulness through local AI and peer to peer sharing. This will also estimate travel time, recognize appointments, etc etc. Open source to the rescue.
- cjhopman 9y ago
  > Google might know a lot about you but they have never exposed that to third party apps It depends on what you mean by exposed. In the context of Cow Clicker (or even the CA stuff) the data wasn't really exposed, it was shared. Google shares your private data all the time. Ex 1. Google+ APIs. Ex 2. Android APIs. Ex 3. Gmail API. Allowing app developers access to information about a user is standard procedure (because otherwise apps would be terrible). Many of these platforms (Android, Facebook, etc.) have, over time, tightened up the access to this information.
Raphmedia 9y ago
Yes, but with android apps, it's my fault for clicking "I accept" next to all of those requested rights. The only one to blame is myself.
- mehrdadn 9y ago
  No? Your friends' contact lists can include you and your birthday or address or whatever. Similar with Facebook.
  - Raphmedia 9y ago
    Well, there's nothing stopping my friends from mailing their personal address books to ads companies. I assume that my name and date of birth are already public domain. They are listed publicly when you register a company. Insurance companies already share that information around anyway. My issue is when Facebook sells my entire internet browsing history.
- prepend 9y ago
  People clicked I accept on Facebook too.
patmcguire 9y ago
Android is a mess, but the really big issue lurking is GSuite OAuth. The "Google Docs" fiasco [1] is proof that for a long time they didn't even prevent impersonation of Google functionality on the platform. The only options for GMail seem to be "access everything" so all the apps do that. It doesn't even seem to be a terms violation to use data for other purposes, I couldn't find that at all for the unenroll.me story. [2] They do have the technical means to offer more nuanced permissions. Things like "send emails and read replies on email threads it creates" or "access to emails matching this kind of search where new search terms would require a re-auth". It's not a priority though. In their defense, millions of people were giving away their passwords to a bunch of external apps and the current situation is better than that. [1] https://www.theverge.com/2017/5/3/15534768/google-docs-phishing-attack-share-this-document-with-you-spam https://www.theverge.com/2017/5/3/15534768/google-docs-phish... [2] https://lifehacker.com/unroll-me-the-email-unsubscription-service-has-been-c-1794593445 https://lifehacker.com/unroll-me-the-email-unsubscription-se...
bluetwo 9y ago
Yep. To be fair Apple's iOS had many of these issues (and still has some), but they seemed to take it a bit more seriously. * * * IMO, which stands for In My Opinion. You are welcome to have your own opinion. Don't expect it to change mine. * *
contextfree 9y ago
What about platforms like Win32, pre-sandboxing MacOS, non-SE Linux where all apps run with full user privileges and the concept of requiring permissions to access sensitive data doesn't even exist?
- sjg007 9y ago
  You can certainly install malware or something like a toolbar that may do nefarious things.. data and ad profiling are the cost of free it seems. Google could vet the apps but they won’t. I’m sure census demographics and your address are predictive enough for a lot of marketing and business related activities. You can also do the hyper ad targeting based on people who live in X and at what age. So the voter profile of CA may not have been specifically more useful than voter registration and demographics. Using Facebook and YouTube was essential though. That allowed them to optimize the content campaigns with real-time feedback.
m_ke 9y ago
Looks like Facebook is already abusing it https://mobile.twitter.com/dylanmckaynz/status/976368845635035138 https://mobile.twitter.com/dylanmckaynz/status/9763688456350...
bitmapbrother 9y ago
>Google must be sweating bullets right now I doubt that very much. You also seem to ignore the lack of runtime permissions in desktop OS's such as Windows and Mac OS that could easily do the same thing. >Every single Android app seems to require access to every single thing This is a lie. The majority of apps ask for only the runtime permissions they need to work. Regardless, you're still in control of the permissions you grant and if you believe an app is asking for permissions which it shouldn't have then you shouldn't grant it.
- GrinningFool 9y ago
  Older, incompatible apps still default to asking for permissions at install time. There are two problems with this - first, I suspect most folks won't know that you can go back and turn those off. That's a relatively new feature, and not really something people will explore on their own. . Second - if it's an app you already installed that has required new permissions, that app can run (via BroadcastReceiver) when it is updated and before you have a chance to alter the fine-grained permissions. Separately, the interface for managing fine-grained permissions in Android is weird. You get most of them in one place, but then it seems you have to check a couple of other places for 'special' permissions? edit: never mind this - it seems like the old version is the one that will get notified, and the permission change only applied ot the new one.
pbalau 9y ago
No, google is safe, they didn't piss off media...
stefan_ 9y ago
Forget about Android apps, I had to grant a Chrome extension access to everything on every website (seemingly the only ACL level for extensions..) so I could get navigate back with backspace...
- nandhp 9y ago
  "Access all data on all websites" isn't the only permission level. However, there are a lot of things extensions do that can only be implemented as hacks within the page the user is viewing, and if you want to run a script in a webpage -- even if it's just `document.addEventListener('keypress', function (e) { if ( e.key == 8 ) history.go(-1) });` -- the browser has to assume it could be reading all the data it wants. You could argue that "adding a browser keybinding" should be a separate API. You're not wrong (I'd love an extension like this to replace Ctrl+Q with Ctrl+Shift+Q), but browser vendors (at least Mozilla) seem to be very reluctant to add more APIs. I was going to mention how I've been confused by people having overreactions like "it's just an extension to rewrite 'millenials' to 'snake people', why is it stealing all of my data?", equating the permission to read data from webpages with an implication that it will steal all your data. This never made much sense to me, since it seemed obvious to me that the required permissions for those things would have to be the same. In light of the Cambridge Analytica situation, though, I realize these fears were very well-founded.

leggomylibro 9y ago

Google is in a bit of a different position. The most information that a malicious app on my friend's phone can access about me is what my friend has stored on their phone about me. Personal things like messaging history and contact information are certainly enough to build a 'social graph', but what Google does not let apps do is access the information that Google stores about me on their servers just because my friend has both my number and a greedy app on their phone.

aylmao 9y ago
Different, but not better IMO, since Facebook solved the friend access problem in 2014 but Google apps still have this issue today. Moreover, Facebook can push updates instantly since it's a web API-- I hope Google has some way of changing this without requiring a full OS update. Also worth considering, Facebook is all about social and preference ("like") data, but live location is something you can get as a mobile app and a lot of stuff can be inferred from where you live/work/visit.
trendia 9y ago
CA was able to extract a personality profile from just likes. Imagine what an app could do if they had access to your entire message history! (Why would anyone give apps access to their messages? So that they can send / receive special emoji, for example.)
- leggomylibro 9y ago
  Well, messaging history is just an example; I'm not actually sure if that is something which apps are allowed to lift, but I figured I'd err on the extreme end. Either way, discrete and easy-to-digest information like 'likes' are exactly what they wouldn't have access to from Google, and honestly it seems like automated sentiment analyses are still very error-prone; large corpuses of text don't seem ideal for this sort of targeting.
- criley2 9y ago
  So these days Facebook requires you to sign a contract to get any significant data or permission any more. I don't think Google does that...
  - deleted 9y ago
    [deleted]
- skybrian 9y ago
  Graphs that connect users are not all the same. For example, it's much more common to follow relatives and people you know in real life on Facebook than on Twitter. (This is one of the reasons Google tried to build Google+: they were worried that not having a real social network would put them at a disadvantage.) It's all privacy leakage but it's not at all the same data. Facebook's graph is still noisy but it's better or at least different data than other companies have.
- Waterluvian 9y ago
  Was the personality profile any good? Otherwise I could make that claim about extracting a personality profile out of tea leaves.
- diyseguy 9y ago
  Seems to me they could make more fine grained permissions. E.g., I don't like that my javascript disabler Firefox plugin has permissions to 'Access data for all websites', 'Access browser tabs'.
cwkoss 9y ago
Can't apps view list of contacts?
- izacus 9y ago
  Not without explicit user permission, no.
mtgx 9y ago
They could extract pictures. In the future, once more devices have AI chips on board and maybe there's an API for seeing what's in the pictures, too, with ML, I could see developers abuse that, and extract all sorts of relevant info from people's phones. Regardless of how dangerous Android permissions are or aren't, I do agree with the larger point that Google is scared about what will happen to Facebook, because it knows those regulations or even a "privacy revolution" that may come in the wake of this will impact it, too. It's probably not even just this one event that will hurt Google. This sentiment has been growing over the past few years. If Google hasn't noticed it growing, then they are out of touch. If the anti-privacy trend continues, it will be bad news for Google, Amazon, Microsoft, and even Apple (which seems to be backtracking on some privacy features lately). I do hope that at the very least the anti-privacy trend pushes companies to limit data gathering and use new privacy-preserving tech that doesn't allow them to look at the data at all. And I hope they do that before it's too late (for them).
throwaway84742 9y ago
>> does not let apps do is access the information Neither does FB I believe. Otherwise their business model of knowing more about you than anybody else would fall apart.
- untog 9y ago
  The whole recent scandal is based around the fact that the FB API does allow apps to download all kinds of user information, and used to let them download data about their friends.
  - throwaway84742 9y ago
    Not “all kinds”. Users routinely approve the use of their friends list, and in this case, this is what was downloaded and data mined, in addition to user’s own profile information. I know this is too much nuance for a lay person to handle, but I expect more from HN readers. The scummy part was that the data was obtained using an app that’s unrelated to what the data was eventually used for, but Android is totally ripe for that as well.
    - untog 9y ago
      "all kinds" isn't exactly a scientifically defined term. Friends list an "profile information" is still very broad. The additional scummy part was that you could authorize FB to download that data for your friends as well as yourself, so your data might be consumed without you ever being aware of, or giving permission for it. As far as I'm aware Android has no such equivalent.
      - throwaway84742 9y ago
        >> could authorize FB to download that data for your friends I don’t believe this is true. You could authorize apps to download a very limited amount of info about your friends. If you have a reference to some authoritative source that proves the opposite, do share. Extraordinary claims demand extraordinary evidence, and all that.
canoebuilder 9y ago
the information that Google stores about me on their servers I've not seen anyone address this, but reading between the lines, many people seem to hold a view that the existence of these finely-grained personal data profiles at this massive scale is fine so long as they exist only on the servers of fb and goog, but why? What makes that acceptable or reasonable, besides the persuasiveness of large amounts of money? I think the clearest path forward is that no one should be creating these kinds of data profiles. I don't think a bot learning my route to work, or a doctor's appt(along with a swath of more "monetizable" personal info) so it can alert me to potential traffic delays is a reasonable trade-off for the massive societal problems the behaviour of creating these data profiles poses. If this data is such a monumental danger when it escapes the permeable confines of the fbs and the googs, then it shouldn't exist within these companies either, not just because as we've seen the confines are quite permeable, but also because the potential for negative use of the data doesn't change depending on who has access to it. It can be persuasively argued that simply creating and collecting these data profiles is itself a negative use of the data.
- skybrian 9y ago
  It might not be okay but it is different. At least in a technical discussion, we should be able to make distinctions rather than treating all data or all breaches the same.
- leggomylibro 9y ago
  I don't think it's acceptable, I just realize that I am powerless to stop it beyond supporting sweeping new regulatory frameworks, which I write to my Congresspeople about but what do you think they're going to do about it? Nothing. And for now, Google's services are worth the data they collect. Facebook's value proposition is comparatively laughable, which might be why so many people are so upset with the scope of how their data was used. And don't even get me started on how users, including those who have not signed up for the service, get tracked on massive swaths of 3rd-party sites if they don't take pains to prevent it - that's downright sinister.
calvinbhai 9y ago
I'm not an Android user, but I feel there's way more data accessible on Android for app developers than many people realize. Photos (on Android and iOS) contain a wealth of information, and any app having access to photos, can clearly figure out where you have been (based on photo's metadata containing GPS location), what you like to eat (if you take a lot of photos of food), where you like to hangout, time of day/week you do certain activities, purely based on image recognition. Any wonder why Google Lens is integrated in the Google Photos app? Add to that, the ability of identifying people from photos (Apple, Facebook and Google do it very well) and you can easily connect the dots, and it'll be hard to escape this kind of data digging, even if you are Jack Reacher. Even pro-privacy Apple doesn't do much in terms of access to photos on iOS. If I want to share one image on Whatsapp on iOS, I have to give Whatsapp access to Photo Album. And once the access is given, a superficial scan can provide WhatsApp full info of locations from my photos, in a few seconds (even if it is 20 GB of photos). Privacy on iOS in this aspect is bad. I can only imagine that Android is much worse.
- izacus 9y ago
  That's simply not true. Apps aren't allowed to access photos without permission on modern Android (6.0+) and you don't need to grant the app full access to photo album just to share an image. Androids intent system always handled these use cases better than iOS did.

guelo 9y ago

Google might know a lot about you but they have never exposed that to third party apps. Facebook's data is much more personal. With a user's "Like" stream it's possible to build a surprisingly accurate personality profile. The worst Android offenders, as always, are the big ad libraries that are installed across a lot of apps. They're able to build a rough personality profile based on the types of apps someone has installed. So they can generally say if a user is into categories like music or politics or comedy. But that problem exists on iOS and the web. Android has also tightened up its permission model considerably over the last several years.

jlarocco 9y ago
> Google might know a lot about you but they have never exposed that to third party apps. How do you know that?
prepend 9y ago
Remember the 2013 Snowden leaks? Google doesn’t have to knowingly expose their info on you, it may happen against their will. Or unknown to them. Even if Google is an altruistic organization, it’s dangerous to have that profile data remote. I hope that local computing can get strong enough to do the same types of assistant type usefulness through local AI and peer to peer sharing. This will also estimate travel time, recognize appointments, etc etc. Open source to the rescue.
cjhopman 9y ago
> Google might know a lot about you but they have never exposed that to third party apps It depends on what you mean by exposed. In the context of Cow Clicker (or even the CA stuff) the data wasn't really exposed, it was shared. Google shares your private data all the time. Ex 1. Google+ APIs. Ex 2. Android APIs. Ex 3. Gmail API. Allowing app developers access to information about a user is standard procedure (because otherwise apps would be terrible). Many of these platforms (Android, Facebook, etc.) have, over time, tightened up the access to this information.

Raphmedia 9y ago

Yes, but with android apps, it's my fault for clicking "I accept" next to all of those requested rights. The only one to blame is myself.

mehrdadn 9y ago
No? Your friends' contact lists can include you and your birthday or address or whatever. Similar with Facebook.
- Raphmedia 9y ago
  Well, there's nothing stopping my friends from mailing their personal address books to ads companies. I assume that my name and date of birth are already public domain. They are listed publicly when you register a company. Insurance companies already share that information around anyway. My issue is when Facebook sells my entire internet browsing history.
prepend 9y ago
People clicked I accept on Facebook too.

patmcguire 9y ago

Android is a mess, but the really big issue lurking is GSuite OAuth. The "Google Docs" fiasco [1] is proof that for a long time they didn't even prevent impersonation of Google functionality on the platform. The only options for GMail seem to be "access everything" so all the apps do that. It doesn't even seem to be a terms violation to use data for other purposes, I couldn't find that at all for the unenroll.me story. [2] They do have the technical means to offer more nuanced permissions. Things like "send emails and read replies on email threads it creates" or "access to emails matching this kind of search where new search terms would require a re-auth". It's not a priority though. In their defense, millions of people were giving away their passwords to a bunch of external apps and the current situation is better than that. [1] https://www.theverge.com/2017/5/3/15534768/google-docs-phishing-attack-share-this-document-with-you-spam https://www.theverge.com/2017/5/3/15534768/google-docs-phish... [2] https://lifehacker.com/unroll-me-the-email-unsubscription-service-has-been-c-1794593445 https://lifehacker.com/unroll-me-the-email-unsubscription-se...

bluetwo 9y ago

Yep. To be fair Apple's iOS had many of these issues (and still has some), but they seemed to take it a bit more seriously. * * * IMO, which stands for In My Opinion. You are welcome to have your own opinion. Don't expect it to change mine. * *

contextfree 9y ago

What about platforms like Win32, pre-sandboxing MacOS, non-SE Linux where all apps run with full user privileges and the concept of requiring permissions to access sensitive data doesn't even exist?

sjg007 9y ago
You can certainly install malware or something like a toolbar that may do nefarious things.. data and ad profiling are the cost of free it seems. Google could vet the apps but they won’t. I’m sure census demographics and your address are predictive enough for a lot of marketing and business related activities. You can also do the hyper ad targeting based on people who live in X and at what age. So the voter profile of CA may not have been specifically more useful than voter registration and demographics. Using Facebook and YouTube was essential though. That allowed them to optimize the content campaigns with real-time feedback.

m_ke 9y ago

Looks like Facebook is already abusing it https://mobile.twitter.com/dylanmckaynz/status/976368845635035138 https://mobile.twitter.com/dylanmckaynz/status/9763688456350...

bitmapbrother 9y ago

>Google must be sweating bullets right now I doubt that very much. You also seem to ignore the lack of runtime permissions in desktop OS's such as Windows and Mac OS that could easily do the same thing. >Every single Android app seems to require access to every single thing This is a lie. The majority of apps ask for only the runtime permissions they need to work. Regardless, you're still in control of the permissions you grant and if you believe an app is asking for permissions which it shouldn't have then you shouldn't grant it.

GrinningFool 9y ago
Older, incompatible apps still default to asking for permissions at install time. There are two problems with this - first, I suspect most folks won't know that you can go back and turn those off. That's a relatively new feature, and not really something people will explore on their own. . Second - if it's an app you already installed that has required new permissions, that app can run (via BroadcastReceiver) when it is updated and before you have a chance to alter the fine-grained permissions. Separately, the interface for managing fine-grained permissions in Android is weird. You get most of them in one place, but then it seems you have to check a couple of other places for 'special' permissions? edit: never mind this - it seems like the old version is the one that will get notified, and the permission change only applied ot the new one.

pbalau 9y ago

No, google is safe, they didn't piss off media...

stefan_ 9y ago

Forget about Android apps, I had to grant a Chrome extension access to everything on every website (seemingly the only ACL level for extensions..) so I could get navigate back with backspace...

nandhp 9y ago
"Access all data on all websites" isn't the only permission level. However, there are a lot of things extensions do that can only be implemented as hacks within the page the user is viewing, and if you want to run a script in a webpage -- even if it's just `document.addEventListener('keypress', function (e) { if ( e.key == 8 ) history.go(-1) });` -- the browser has to assume it could be reading all the data it wants. You could argue that "adding a browser keybinding" should be a separate API. You're not wrong (I'd love an extension like this to replace Ctrl+Q with Ctrl+Shift+Q), but browser vendors (at least Mozilla) seem to be very reluctant to add more APIs. I was going to mention how I've been confused by people having overreactions like "it's just an extension to rewrite 'millenials' to 'snake people', why is it stealing all of my data?", equating the permission to read data from webpages with an implication that it will steal all your data. This never made much sense to me, since it seemed obvious to me that the required permissions for those things would have to be the same. In light of the Cambridge Analytica situation, though, I realize these fears were very well-founded.