5 ms·

This is already possible, some apps launch a file picker app (what you're supposed to do). Instead, apps that want to steal your pictures request access to all

This is already possible, some apps launch a file picker app (what you're supposed to do). Instead, apps that want to steal your pictures request access to all of them.

colordrops 9y ago
That should be something that doesn't allow the app to get onto the Play store, but Google apparently allows it.
- halflings 9y ago
  You need that permission for a photo viewer, but I guess you're right that apps asking for overly broad permissions should be banned.
nitrogen 9y ago
Android used to have the concept of an Intent. Does that still exist, and if so, why do apps still require full storage permissions? Side note, there was also a project at one point to create Web Intents. I wonder what the web would be like if that had worked out.
- Groxx 9y ago
  Intents are alive and well, but they've been broadly crippled until recently-ish (well. they still are, but at least now you can read/write stuff in a user-defined folder... kinda.). And the fancier stuff is totally broken on a large number of devices. And it's fairly complicated to support all of it and still be backwards compatible for older OSes that don't have it. But yes! It exists, and most applications could pretty easily use it instead. But most of it seems to be laziness / misunderstanding. And Android's broadly terrible documentation does not help this at all. E.g. a huge number of apps that want external storage permissions just use it to store external caches outside your system partition, which is very nice for people with an SD card / limited internal space. Many companies don't seem aware that this no longer requires any permissions though - you can store internal and external data in your app-sandboxed folders by default.
Groxx 9y ago
Android has a lot of nasty corners around stuff like this, which can prevent being both streamlined (accessing all photos does let you optimize for your app, some people want that) and privacy-friendly (for people who don't want that). My personal favorite: If you don't request camera permission, you can still open the camera with an intent. This is great! If you do request camera permission, and you are denied, you can't use that intent either. https://blog.egorand.me/taking-photos-not-so-simply-how-i-got-bitten-by-action_image_capture/ https://blog.egorand.me/taking-photos-not-so-simply-how-i-go... I honestly can't tell if it's this way to be intentionally hostile to users, or by accident, or if they honestly think this is a positive quality.
- rasz 9y ago
  I dont understand your frustration, user clearly doesnt want to give you camera access, leave him alone.
  - rocho 9y ago
    You are missing the point, which is that you can bypass the permission system completely by directly launching the camera intent.
  - Groxx 9y ago
    "Give app X direct access to the camera, microphone, and all my photos literally any time it pleases" and "use this camera app I trust instead" are very, very different desires. Usually I hate the in-app cameras, because they're not optimized for my device. They're usually slower, have no flash control, no zoom, no manual exposure options, etc. I'd almost always prefer to use a dedicated camera app instead. Because of this permissions decision, if an app wants to bake in a camera thing (nearly every app that might ever touch the camera does, even if e.g. only for a QR code reader or something), I can no longer choose. The app can't open my camera app when it makes sense.
- danjoc 9y ago
  Vacuuming up your data is intentional. Google Android. Don't like it? Use/build AOSP derivatives.
BartBoch 9y ago
This would be easier to control if Android would allow users an option to see historically what resources the app requested and how it processed them (just list them, used them, processed them).
- antpls 9y ago
  I'm not sure about recent Android version, but on my 3~4 years old Alcatel with Android v4.3, there is already a rudimentary preference menu listing the last accesses of app to resources (eg "Instagram accessed contact list 3 hours ago"). The menu is not easily accessible, I found it by chance.
  - Sylos 9y ago
    You're probably seeing the App Ops menu. That appeared in 4.3, hardly accessible. Was made somewhat more accessible in 4.4 and then was patched out in something like 4.4.1 or so. I presume, some Google exec got to know of it and demanded it removed. Starting with Android 6, there's the new permission model, meaning that a similar screen is added to the settings of each app, but it doesn't show when an access happened (or at least it does not for me on Android 8.1).
- crtasm 9y ago
  DTEK by Blackberry app can track/notify on foreground and background permissions usage (but there's no data from before you install it). To log how requested data is actually being used by an app doesn't sound possible to me.
  - BartBoch 9y ago
    Probably not, but the method of "fetch" should be possible - either it lists resources, grabs variables, grabs whole images etc.
    - crtasm 9y ago
      Ah I see, yes it would be great if Android made that info available.

This is already possible, some apps launch a file picker app (what you're supposed to do). Instead, apps that want to steal your pictures request access to all of them.

colordrops 9y ago

That should be something that doesn't allow the app to get onto the Play store, but Google apparently allows it.

halflings 9y ago
You need that permission for a photo viewer, but I guess you're right that apps asking for overly broad permissions should be banned.

nitrogen 9y ago

Android used to have the concept of an Intent. Does that still exist, and if so, why do apps still require full storage permissions? Side note, there was also a project at one point to create Web Intents. I wonder what the web would be like if that had worked out.

Groxx 9y ago
Intents are alive and well, but they've been broadly crippled until recently-ish (well. they still are, but at least now you can read/write stuff in a user-defined folder... kinda.). And the fancier stuff is totally broken on a large number of devices. And it's fairly complicated to support all of it and still be backwards compatible for older OSes that don't have it. But yes! It exists, and most applications could pretty easily use it instead. But most of it seems to be laziness / misunderstanding. And Android's broadly terrible documentation does not help this at all. E.g. a huge number of apps that want external storage permissions just use it to store external caches outside your system partition, which is very nice for people with an SD card / limited internal space. Many companies don't seem aware that this no longer requires any permissions though - you can store internal and external data in your app-sandboxed folders by default.

Groxx 9y ago

Android has a lot of nasty corners around stuff like this, which can prevent being both streamlined (accessing all photos does let you optimize for your app, some people want that) and privacy-friendly (for people who don't want that). My personal favorite: If you don't request camera permission, you can still open the camera with an intent. This is great! If you do request camera permission, and you are denied, you can't use that intent either. https://blog.egorand.me/taking-photos-not-so-simply-how-i-got-bitten-by-action_image_capture/ https://blog.egorand.me/taking-photos-not-so-simply-how-i-go... I honestly can't tell if it's this way to be intentionally hostile to users, or by accident, or if they honestly think this is a positive quality.

rasz 9y ago
I dont understand your frustration, user clearly doesnt want to give you camera access, leave him alone.
- rocho 9y ago
  You are missing the point, which is that you can bypass the permission system completely by directly launching the camera intent.
- Groxx 9y ago
  "Give app X direct access to the camera, microphone, and all my photos literally any time it pleases" and "use this camera app I trust instead" are very, very different desires. Usually I hate the in-app cameras, because they're not optimized for my device. They're usually slower, have no flash control, no zoom, no manual exposure options, etc. I'd almost always prefer to use a dedicated camera app instead. Because of this permissions decision, if an app wants to bake in a camera thing (nearly every app that might ever touch the camera does, even if e.g. only for a QR code reader or something), I can no longer choose. The app can't open my camera app when it makes sense.
danjoc 9y ago
Vacuuming up your data is intentional. Google Android. Don't like it? Use/build AOSP derivatives.

BartBoch 9y ago

This would be easier to control if Android would allow users an option to see historically what resources the app requested and how it processed them (just list them, used them, processed them).

antpls 9y ago
I'm not sure about recent Android version, but on my 3~4 years old Alcatel with Android v4.3, there is already a rudimentary preference menu listing the last accesses of app to resources (eg "Instagram accessed contact list 3 hours ago"). The menu is not easily accessible, I found it by chance.
- Sylos 9y ago
  You're probably seeing the App Ops menu. That appeared in 4.3, hardly accessible. Was made somewhat more accessible in 4.4 and then was patched out in something like 4.4.1 or so. I presume, some Google exec got to know of it and demanded it removed. Starting with Android 6, there's the new permission model, meaning that a similar screen is added to the settings of each app, but it doesn't show when an access happened (or at least it does not for me on Android 8.1).
crtasm 9y ago
DTEK by Blackberry app can track/notify on foreground and background permissions usage (but there's no data from before you install it). To log how requested data is actually being used by an app doesn't sound possible to me.
- BartBoch 9y ago
  Probably not, but the method of "fetch" should be possible - either it lists resources, grabs variables, grabs whole images etc.
  - crtasm 9y ago
    Ah I see, yes it would be great if Android made that info available.