3 ms·

Much of this blame goes on Android and some on iOS/Apple. The phone/call permissions, especially for Android, were needed for any app that wants to suspend whe

Much of this blame goes on Android and some on iOS/Apple. The phone/call permissions, especially for Android, were needed for any app that wants to suspend when a call comes in and for analytics/social libs. I always hated that about Android especially because even harmless games made it look like you were taking contacts and monitoring calls. Of course this would be abused and it is all over the place. Unfortunately lots of apps/games are specifically built to harvest data and this was a major flaw in their permissions handling. You shouldn't need a monitor phone calls permission to allow a call to come in over your app while someone is using or playing it.

soziawa 9y ago
> Much of this blame goes on Android and some on iOS/Apple. Which part of the blame goes on Apple?
- endymi0n 9y ago
  Apple had zero permission management on the contact book, it was wide open. Especially FB and LinkedIn exploited that heavily and partly do to this day.
  - jahnu 9y ago
    Oh really? I didn't know that. Can you link me up with something about that? Thanks.
    - drawkbox 9y ago
      Many apps grabbed contact lists. Path for instance even had an issue with the FTC due to it [1]. Apple implemented better permissions pretty quickly. I recall other apps doing the same up to 2013. [1] https://www.ftc.gov/news-events/press-releases/2013/02/path-social-networking-app-settles-ftc-charges-it-deceived https://www.ftc.gov/news-events/press-releases/2013/02/path-...
  - stefanmm 9y ago
    not so true. "Users can grant or deny access to contact data on a per-app basis. Any call to CNContactStore will block the app while the user is being asked to grant or deny access. Note that the user is prompted only the first time access is requested; any subsequent CNContactStore calls use the existing permissions." https://developer.apple.com/documentation/contacts#1773385 https://developer.apple.com/documentation/contacts#1773385
    - drawkbox 9y ago
      They do today, back up to 2012-2013 they did not. Apps were also overly abusing it back then such as Path [1] and many others. > The operator of the Path social networking app has agreed to settle Federal Trade Commission charges that it deceived users by collecting personal information from their mobile device address books without their knowledge and consent. Android didn't really close/tighten permissions until 2014 with Android 4 Ice Cream. [1] https://www.ftc.gov/news-events/press-releases/2013/02/path-social-networking-app-settles-ftc-charges-it-deceived https://www.ftc.gov/news-events/press-releases/2013/02/path-...
orb_yt 9y ago
> The phone/call permissions, especially for Android, were needed for any app that wants to suspend when a call comes in. No they weren't
- drawkbox 9y ago
  You need/needed READ_PHONE_STATE if you wanted to suspend your app data/saving and allow calls to be accepted you did. For instance you are playing a game and a call comes in, you needed them to allow that and to possibly not crash your game and save your data as well as for some analytics/social network integration. Also if you allowed os level music to be played over game audio, you need that to handle music and app state when a call came in. It was/is a default on many large app platforms including game engines like Unity and any social network app integration such as Google Play Game Services and Unity analytics [1][2]. When you have READ_PHONE_STATE you could get the number and more. For games it wasn't such a big thing but for apps like Facebook that are always running and kept alive playing a silent sound [3], it could get every call that ever came in on record and apparently did. With these holes, apps could scrape everything and they did [4]. [1] https://forum.unity.com/threads/unity-5-1-adds-android-permission-read_phone_state-automatically-how-to-remove-it.333431/ https://forum.unity.com/threads/unity-5-1-adds-android-permi... [2] https://stackoverflow.com/questions/39668549/why-has-the-read-phone-state-permission-been-added https://stackoverflow.com/questions/39668549/why-has-the-rea... [3] https://www.reddit.com/r/iphone/comments/3opxhm/facebook_app_appears_to_use_silent_audio_for/ https://www.reddit.com/r/iphone/comments/3opxhm/facebook_app... [4] https://arstechnica.com/information-technology/2018/03/facebook-scraped-call-text-message-data-for-years-from-android-phones/ https://arstechnica.com/information-technology/2018/03/faceb...
  - icebraining 9y ago
    Where's the reference that you needed READ_PHONE_STATE to suspend your app? Shouldn't the app be automatically suspended when the caller app goes into the foreground?
    - drawkbox 9y ago

soziawa 9y ago

> Much of this blame goes on Android and some on iOS/Apple. Which part of the blame goes on Apple?

endymi0n 9y ago
Apple had zero permission management on the contact book, it was wide open. Especially FB and LinkedIn exploited that heavily and partly do to this day.
- jahnu 9y ago
  Oh really? I didn't know that. Can you link me up with something about that? Thanks.
  - drawkbox 9y ago
    Many apps grabbed contact lists. Path for instance even had an issue with the FTC due to it [1]. Apple implemented better permissions pretty quickly. I recall other apps doing the same up to 2013. [1] https://www.ftc.gov/news-events/press-releases/2013/02/path-social-networking-app-settles-ftc-charges-it-deceived https://www.ftc.gov/news-events/press-releases/2013/02/path-...
- stefanmm 9y ago
  not so true. "Users can grant or deny access to contact data on a per-app basis. Any call to CNContactStore will block the app while the user is being asked to grant or deny access. Note that the user is prompted only the first time access is requested; any subsequent CNContactStore calls use the existing permissions." https://developer.apple.com/documentation/contacts#1773385 https://developer.apple.com/documentation/contacts#1773385
  - drawkbox 9y ago
    They do today, back up to 2012-2013 they did not. Apps were also overly abusing it back then such as Path [1] and many others. > The operator of the Path social networking app has agreed to settle Federal Trade Commission charges that it deceived users by collecting personal information from their mobile device address books without their knowledge and consent. Android didn't really close/tighten permissions until 2014 with Android 4 Ice Cream. [1] https://www.ftc.gov/news-events/press-releases/2013/02/path-social-networking-app-settles-ftc-charges-it-deceived https://www.ftc.gov/news-events/press-releases/2013/02/path-...

orb_yt 9y ago

> The phone/call permissions, especially for Android, were needed for any app that wants to suspend when a call comes in. No they weren't

drawkbox 9y ago
You need/needed READ_PHONE_STATE if you wanted to suspend your app data/saving and allow calls to be accepted you did. For instance you are playing a game and a call comes in, you needed them to allow that and to possibly not crash your game and save your data as well as for some analytics/social network integration. Also if you allowed os level music to be played over game audio, you need that to handle music and app state when a call came in. It was/is a default on many large app platforms including game engines like Unity and any social network app integration such as Google Play Game Services and Unity analytics [1][2]. When you have READ_PHONE_STATE you could get the number and more. For games it wasn't such a big thing but for apps like Facebook that are always running and kept alive playing a silent sound [3], it could get every call that ever came in on record and apparently did. With these holes, apps could scrape everything and they did [4]. [1] https://forum.unity.com/threads/unity-5-1-adds-android-permission-read_phone_state-automatically-how-to-remove-it.333431/ https://forum.unity.com/threads/unity-5-1-adds-android-permi... [2] https://stackoverflow.com/questions/39668549/why-has-the-read-phone-state-permission-been-added https://stackoverflow.com/questions/39668549/why-has-the-rea... [3] https://www.reddit.com/r/iphone/comments/3opxhm/facebook_app_appears_to_use_silent_audio_for/ https://www.reddit.com/r/iphone/comments/3opxhm/facebook_app... [4] https://arstechnica.com/information-technology/2018/03/facebook-scraped-call-text-message-data-for-years-from-android-phones/ https://arstechnica.com/information-technology/2018/03/faceb...
- icebraining 9y ago
  Where's the reference that you needed READ_PHONE_STATE to suspend your app? Shouldn't the app be automatically suspended when the caller app goes into the foreground?
  - drawkbox 9y ago