5 ms·

I don't have an Android phone so excuse my nativity but does Android allow an app to request more permissions AFTER it has already been installed and requested

I don't have an Android phone so excuse my nativity but does Android allow an app to request more permissions AFTER it has already been installed and requested the original perms? If so, why? Additionally, if users cannot deny individual perms then they will have to make an all-or-nothing-decision about an app. Why not just allow them to disable specific perms on install and provide stubbed generic data to the app if it uses those perms?

azthec 8y ago
On the newer versions it generally does not ask for permissions on install but rather when they are needed, you can choose to decline, some applications might then misbehave. On older version like kitkat you are forced to accept all of the requested (and often very intrusive) permissions or not install the application at all.
- carlmr 8y ago
  I think request upon needing the permission makes a lot of sense. After all when you do an action and it requests a permission you at least have a chance to understand why it's needed. Wouldn't it make sense to have temporary permissions? In Linux and Windows you have to sudo/admin also for one single action or a set of actions. You don't give a program access rights for eternity. Maybe I want to use some app's location service only very rarely and I fear that it has some surveillance features integrated. If I'm ok sharing my location right now, I might not be ok sharing it always. It would be good to have the ability to give it the permission once, until a system restart, or for a limited timeframe.
  - caf 8y ago
    It's not automatic, but you can revoke previously-granted permissions manually by going into Settings -> Apps & Notifications -> {App} -> Permissions.
    - carlmr 8y ago
      I know it's possible, but it completely ignores the reality how humans aren't perfect robots that don't forget or become lazy.
annabellish 8y ago
There have been (third party) permissions systems which do provide generic data if the permission is denied, but the modern android permission system is more just based around developers having to acknowledge that those permissions might be denied and that they should still do their best. Currently, _all_ permissions are requested in a two stage system - the app publishes which permissions it _can_ request, and any changes to that list cause updates to pause pending user acceptance, but does not actually get to use those permissions until requested in code, which flags up a specific yes/no request prompt to the user. The systems which provided generic data worked very well a lot of the time, but also some of the time would just subtly break things in a way which was not obvious for a non-technical user.
- cornholio 8y ago
  > The systems which provided generic data worked very well a lot of the time, but also some of the time would just subtly break things in a way which was not obvious for a non-technical user. Is this available via a non-root API? There are those blackmailing applications that refuse to do their core functionality when a certain unrelated permission is denied (the hell you need my location, music streaming app!). If Android fed them generic data, they would quickly learn to detect it - but not if data is controlled by other Apps or the user himself.
  - annabellish 8y ago
    I don't believe so, integrating such a thing is a pretty big change, though I believe there are (or at least were, last I checked) systems which didn't require a full custom OS to work with.
IChrisI 8y ago
Requesting permissions for everything your app can possibly do at install time makes apps look scary. Here's an example. Imaging a messaging app. It needs permission to read and write to your text messages - not so bad. Maybe there's a feature where you can quick-reply from the message notification. Now it needs permission to draw over other apps. Maybe it's smart enough to not DING! during a phone call. Now it needs permission to "make and manage phone calls". Maybe there's a feature where it suggests a "here's my location" response when somebody texts you "where are you?". Now it needs permission to access your location. Contact integration? Camera integration? Access storage? These are all things that a messaging app might reasonably want to do. But seeing a big list of permissions, including things like "draw over other apps" and "make and manage phone calls" is scary to an end user. Especially for an app that's only supposed to be handling SMS.
- amelius 8y ago
  I really hate it when I need to send a single file or photo, an app suddenly "needs access to my filesystem" and I have to grant that access. OSes should allow me to create a sandbox for an app, so I can grant them access (and the app will not "break"), while still being secure.
  - felix_nagaand 8y ago
    Your solution is too simple and intuitive.
  - duiker101 8y ago
    And then you need to app to the sandbox? Seems even more complex
    - mobilio 8y ago
      Actually isn't. And this was already implemented in iOS and Windows Mobile.
  - HappyRobot 8y ago
    I thought Android apps were sandboxed [1]. The "needs access to my file system" is the way for data to transfer into that sandbox. Android should add the option for temporary data access. I would prefer turning on the access temporarily to send 1 photo, then turning it off a few minutes later. https://developer.android.com/training/articles/security-tips https://developer.android.com/training/articles/security-tip...
mrec 8y ago
I picked up a cheap Android a couple of years ago to see if mobiles had become worth the hassle yet. Permissions handling was one of the big things that convinced me they hadn't. The most memorable example was trying to take a picture and the camera app telling me it needed permission to make phone calls. I still can't think of a single valid reason why a camera would need to make phone calls, so I refused, and blam, no pictures for me.
- fengb 8y ago
  There’s an OS reason: the only way to detect if there’s an incoming or ongoing phone cal is by having full phone permissions.
- trash_panda 8y ago
  You may find this project interesting: https://simplemobiletools.github.io/ https://simplemobiletools.github.io/

azthec 8y ago

On the newer versions it generally does not ask for permissions on install but rather when they are needed, you can choose to decline, some applications might then misbehave. On older version like kitkat you are forced to accept all of the requested (and often very intrusive) permissions or not install the application at all.

carlmr 8y ago
I think request upon needing the permission makes a lot of sense. After all when you do an action and it requests a permission you at least have a chance to understand why it's needed. Wouldn't it make sense to have temporary permissions? In Linux and Windows you have to sudo/admin also for one single action or a set of actions. You don't give a program access rights for eternity. Maybe I want to use some app's location service only very rarely and I fear that it has some surveillance features integrated. If I'm ok sharing my location right now, I might not be ok sharing it always. It would be good to have the ability to give it the permission once, until a system restart, or for a limited timeframe.
- caf 8y ago
  It's not automatic, but you can revoke previously-granted permissions manually by going into Settings -> Apps & Notifications -> {App} -> Permissions.
  - carlmr 8y ago
    I know it's possible, but it completely ignores the reality how humans aren't perfect robots that don't forget or become lazy.

annabellish 8y ago

There have been (third party) permissions systems which do provide generic data if the permission is denied, but the modern android permission system is more just based around developers having to acknowledge that those permissions might be denied and that they should still do their best. Currently, _all_ permissions are requested in a two stage system - the app publishes which permissions it _can_ request, and any changes to that list cause updates to pause pending user acceptance, but does not actually get to use those permissions until requested in code, which flags up a specific yes/no request prompt to the user. The systems which provided generic data worked very well a lot of the time, but also some of the time would just subtly break things in a way which was not obvious for a non-technical user.

cornholio 8y ago
> The systems which provided generic data worked very well a lot of the time, but also some of the time would just subtly break things in a way which was not obvious for a non-technical user. Is this available via a non-root API? There are those blackmailing applications that refuse to do their core functionality when a certain unrelated permission is denied (the hell you need my location, music streaming app!). If Android fed them generic data, they would quickly learn to detect it - but not if data is controlled by other Apps or the user himself.
- annabellish 8y ago
  I don't believe so, integrating such a thing is a pretty big change, though I believe there are (or at least were, last I checked) systems which didn't require a full custom OS to work with.

IChrisI 8y ago

Requesting permissions for everything your app can possibly do at install time makes apps look scary. Here's an example. Imaging a messaging app. It needs permission to read and write to your text messages - not so bad. Maybe there's a feature where you can quick-reply from the message notification. Now it needs permission to draw over other apps. Maybe it's smart enough to not DING! during a phone call. Now it needs permission to "make and manage phone calls". Maybe there's a feature where it suggests a "here's my location" response when somebody texts you "where are you?". Now it needs permission to access your location. Contact integration? Camera integration? Access storage? These are all things that a messaging app might reasonably want to do. But seeing a big list of permissions, including things like "draw over other apps" and "make and manage phone calls" is scary to an end user. Especially for an app that's only supposed to be handling SMS.

amelius 8y ago
I really hate it when I need to send a single file or photo, an app suddenly "needs access to my filesystem" and I have to grant that access. OSes should allow me to create a sandbox for an app, so I can grant them access (and the app will not "break"), while still being secure.
- felix_nagaand 8y ago
  Your solution is too simple and intuitive.
- duiker101 8y ago
  And then you need to app to the sandbox? Seems even more complex
  - mobilio 8y ago
    Actually isn't. And this was already implemented in iOS and Windows Mobile.
- HappyRobot 8y ago
  I thought Android apps were sandboxed [1]. The "needs access to my file system" is the way for data to transfer into that sandbox. Android should add the option for temporary data access. I would prefer turning on the access temporarily to send 1 photo, then turning it off a few minutes later. https://developer.android.com/training/articles/security-tips https://developer.android.com/training/articles/security-tip...

mrec 8y ago

I picked up a cheap Android a couple of years ago to see if mobiles had become worth the hassle yet. Permissions handling was one of the big things that convinced me they hadn't. The most memorable example was trying to take a picture and the camera app telling me it needed permission to make phone calls. I still can't think of a single valid reason why a camera would need to make phone calls, so I refused, and blam, no pictures for me.

fengb 8y ago
There’s an OS reason: the only way to detect if there’s an incoming or ongoing phone cal is by having full phone permissions.
trash_panda 8y ago
You may find this project interesting: https://simplemobiletools.github.io/ https://simplemobiletools.github.io/