4 ms·

I would agree with you if only Signal would not ask for so many permissions on my phone.

by lowry 8y ago

tekromancr 8y ago
Can you elaborate? I just set it up on a new phone yesterday and all it asked for on mine was; contacts (makes sense) files (to send pictures, files, etc) receive and send texts (if you want it as your default texting app/validating phone number via sms) Access to camera and microphone (for calls and in app photography) These all seem like reasonable permissions for the features available.
- staticautomatic 8y ago
  Is sharing your contacts mandatory in Signal? I don't use WhatsApp because I can't without sharing them.
  - Angostura 8y ago
    No. That’s the primary reason I use Signal rather than WhatsApp. With Signal, you just need to give it the contacts that you want to chat with vua Signal.
  - soperj 8y ago
    no, it isn't.
degenerate 8y ago
It would be great if it asked for those permissions when it needed to do something - for example ask for mic permission at the point you want to make your first voice call. I see some apps going that direction and it's refreshing. edit: Apparently, Signal does this for some things? See comment-replies.
- tialaramex 8y ago
  On Android that's version dependant. Older Android versions only had the idea of the app declaring "I need to be able to use your Camera, read your Contacts, and make $$$ phone calls" and then you pick "No" and don't get the app or you pick "OK". This more or less railroads users into pressing "OK", except for the most security conscious, who go without the app. A few releases back Google had an unofficial feature that let you switch off features an app had, and it would get some dummy replacement, e.g. if it had Contacts access but you switched that off, it would see no Contacts at all. If it had Camera access, but that was switched off, it would always be told your Camera was busy in another app. Once word about this hidden feature got out, Google disabled it. Recent releases (Certainly on my Nexus 5X for example which is a while back) enable an app to ask at runtime. If you said "No" the app gets a second chance to explain itself, and then if you keep saying "No" the feature is just disabled and Android stops prompting you. The app might not work after that of course. Like the disabled older feature, the Settings pages for apps let you undo previous authorizations, again this may make certain apps malfunction - a map app with no GPS is merely crippled, but a "barcode scanner" with no Camera access is junk. However of course apps for an older phone don't prompt, the older Android can't handle it, so for them you still have to make the decision at install time.
  - mrguyorama 8y ago
    The permissions system that android apps use is entirely dependent on which API version you target. Last I understood, if you made a new app today and purposely chose to target an old API version, you could force it to use the "all or nothing", user hostile permissions query you described
    - saagarjha 8y ago
      I believe Google is asking developers to support a recent API version to push updates to the Play Store.
      - bigiain 8y ago
        Yeah - as of 1 Aug new apps or 1 Nov for updated apps - you need to "target" API level 26 (Android 8), but you can still set your minSdkVersion to whatever you like (we're still publishing version 16/Android 4.4 updated). https://developer.android.com/distribute/best-practices/develop/target-sdk https://developer.android.com/distribute/best-practices/deve... @mrguyorama - this means you can force the old landgrab user-hostile permissions to people running old Android versions, but you cannot force them onto users running Android 8.
- jlund 8y ago
  It does. Signal supports runtime permissions[1] and it requests them dynamically while you are using the app (e.g. the camera permission prompt appears the first time you try to take a picture). 1: https://developer.android.com/training/permissions/requesting https://developer.android.com/training/permissions/requestin...
dleslie 8y ago
Last time I had it installed it scanned my contacts a half dozen times while I slept. I removed it in the AM.
- balladeer 8y ago
  To be fair it does that to map you with the contacts who also are on Signal just like WhatsApp or Telegram does. Though you could also use Telegram just with user_names w/o phonebook permission but for signing up you need to use your actual phone number.
- jlund 8y ago
  The Contacts permission is completely optional, and contact information is never stored: https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/
  - ppjet6 8y ago
    This seems like smoke and mirrors to me: Traditionally, in Signal that process has looked like: The client calculates the truncated SHA256 hash of each phone number in the device’s address book. The client transmits those truncated hashes to the service. The service does a lookup from a set of hashed registered users. The service returns the intersection of registered users. The phone number space is really not this big.
    - detaro 8y ago
      They acknowledge that in literally the next paragraph, and the entire post is about how they improved on that old state of things. How is that "smoke and mirrors"?
      - ppjet6 8y ago
        Right, my bad. This does look like a sensible solution

I would agree with you if only Signal would not ask for so many permissions on my phone.

by lowry 8y ago

I would agree with you if only Signal would not ask for so many permissions on my phone.

Can you elaborate? I just set it up on a new phone yesterday and all it asked for on mine was; contacts (makes sense) files (to send pictures, files, etc) receive and send texts (if you want it as your default texting app/validating phone number via sms) Access to camera and microphone (for calls and in app photography) These all seem like reasonable permissions for the features available.

staticautomatic 8y ago
Is sharing your contacts mandatory in Signal? I don't use WhatsApp because I can't without sharing them.
- Angostura 8y ago
  No. That’s the primary reason I use Signal rather than WhatsApp. With Signal, you just need to give it the contacts that you want to chat with vua Signal.
- soperj 8y ago
  no, it isn't.

degenerate 8y ago

It would be great if it asked for those permissions when it needed to do something - for example ask for mic permission at the point you want to make your first voice call. I see some apps going that direction and it's refreshing. edit: Apparently, Signal does this for some things? See comment-replies.

tialaramex 8y ago
On Android that's version dependant. Older Android versions only had the idea of the app declaring "I need to be able to use your Camera, read your Contacts, and make $$$ phone calls" and then you pick "No" and don't get the app or you pick "OK". This more or less railroads users into pressing "OK", except for the most security conscious, who go without the app. A few releases back Google had an unofficial feature that let you switch off features an app had, and it would get some dummy replacement, e.g. if it had Contacts access but you switched that off, it would see no Contacts at all. If it had Camera access, but that was switched off, it would always be told your Camera was busy in another app. Once word about this hidden feature got out, Google disabled it. Recent releases (Certainly on my Nexus 5X for example which is a while back) enable an app to ask at runtime. If you said "No" the app gets a second chance to explain itself, and then if you keep saying "No" the feature is just disabled and Android stops prompting you. The app might not work after that of course. Like the disabled older feature, the Settings pages for apps let you undo previous authorizations, again this may make certain apps malfunction - a map app with no GPS is merely crippled, but a "barcode scanner" with no Camera access is junk. However of course apps for an older phone don't prompt, the older Android can't handle it, so for them you still have to make the decision at install time.
- mrguyorama 8y ago
  The permissions system that android apps use is entirely dependent on which API version you target. Last I understood, if you made a new app today and purposely chose to target an old API version, you could force it to use the "all or nothing", user hostile permissions query you described
  - saagarjha 8y ago
    I believe Google is asking developers to support a recent API version to push updates to the Play Store.
    - bigiain 8y ago
      Yeah - as of 1 Aug new apps or 1 Nov for updated apps - you need to "target" API level 26 (Android 8), but you can still set your minSdkVersion to whatever you like (we're still publishing version 16/Android 4.4 updated). https://developer.android.com/distribute/best-practices/develop/target-sdk https://developer.android.com/distribute/best-practices/deve... @mrguyorama - this means you can force the old landgrab user-hostile permissions to people running old Android versions, but you cannot force them onto users running Android 8.
jlund 8y ago
It does. Signal supports runtime permissions[1] and it requests them dynamically while you are using the app (e.g. the camera permission prompt appears the first time you try to take a picture). 1: https://developer.android.com/training/permissions/requesting https://developer.android.com/training/permissions/requestin...

dleslie 8y ago

Last time I had it installed it scanned my contacts a half dozen times while I slept. I removed it in the AM.

balladeer 8y ago
To be fair it does that to map you with the contacts who also are on Signal just like WhatsApp or Telegram does. Though you could also use Telegram just with user_names w/o phonebook permission but for signing up you need to use your actual phone number.
jlund 8y ago
The Contacts permission is completely optional, and contact information is never stored: https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/
- ppjet6 8y ago
  This seems like smoke and mirrors to me: Traditionally, in Signal that process has looked like: The client calculates the truncated SHA256 hash of each phone number in the device’s address book. The client transmits those truncated hashes to the service. The service does a lookup from a set of hashed registered users. The service returns the intersection of registered users. The phone number space is really not this big.
  - detaro 8y ago
    They acknowledge that in literally the next paragraph, and the entire post is about how they improved on that old state of things. How is that "smoke and mirrors"?
    - ppjet6 8y ago
      Right, my bad. This does look like a sensible solution