6 ms·

A revocable permission for network access on Android would be a great step towards giving users more control over which apps can transmit their personal data.

A revocable permission for network access on Android would be a great step towards giving users more control over which apps can transmit their personal data. An entire class of apps could be rendered safe by disallowing network access, especially the ones that do work offline, but are keen to phone home.

kerng 7y ago
Right on! Those are the very features that I'm missing! It seems super simple to provide that basic level of control to the end user. I also want shadow/fake address books and location information as a feature.
llarsson 7y ago
A cheap Huawei phone I had let me do that, right from its Settings! Now I have to use NetGuard for that (no root required). And this is how I have learned that Google's Calc app apparently wants network access. No thanks!
ignoramous 7y ago
This has been possible since Android 8, if not before. You could, per app, from the App Info page: 1. Disallow bg internet access. 2. Disallow fg internet access over wifi. 3. Disallow fg internet access over mobile network. I've been building an app that exposes privacy features like bouncing permissions when apps are in bg (remember AppOps?), firewalling apps by disallowing data usage, setting DNS over TLS to servers that blackhole ads and trackers, show log of network activity, kill bg processes and activities and so on. Hopefully, would be done in a month or so. You could do all of the above, today, but mostly, manually, by navigating through nested menus and what-not. Android 10 would make some parts of what I'm building obsolete, and that's a good thing.
- deleted 7y ago
  [deleted]
- dessant 7y ago
  Is it possible that some of the controls for these network permissions you list are not in AOSP, but in a ROM made by the manufacturer of your device? The ones I've seen had a setting only for restricting background data usage.
  - ignoramous 7y ago
    I've exercised this setting in Xiaomi, Oppo phones (Realme, Vivo, One Plus included) [0]. Unsure if it is in AOSP, but a user reported that its present in their Pixel running 8.1 [0]? You could see if NoRoot Firewall (requires VPN) or Glasswire (may or may not require VPN) help you disallow internet access per-app. [0] https://old.reddit.com/r/oneplus/comments/79g0ue/til_oxygenos_has_a_firewall_to_block_4g_or_wifi/ https://old.reddit.com/r/oneplus/comments/79g0ue/til_oxygeno...
    - saagarjha 7y ago
      This might be a Chinese thing: iPhones sold there have an option to disable apps from connecting to WLAN but I haven't seen this on any other SKU.
      - deleted 7y ago
        [deleted]
- HenryBemis 7y ago
  Since I never trusted iOS setup that one cannot restrict WiFi access on apps I had a firewall on my (jailbroken iOS). Now on Android I do the same (not trust the OS or the Data/WiFi switches and again I use a firewall to block either Data or WiFi or both. I also do this for data usage, e.g. Spotify and my podcatcher use Wi-fi while email etc use both data and WiFi. Edit: in the same spirit I block all free apps that don't require network connectivity such as health/workout apps. I kill all ads, and keep my data within. Edit2: android firewall is called "NoRoot Firewall"
- Someone1234 7y ago
  I have a Pixel 3 with the latest retail release (Android 9/August 1, 2019). I cannot do any of the things you described for any apps via the App Info page. I have permissions sliders for Camera, Contacts, Location, Microphone, Phone, and Storage. None at all for internet access or any specific network. The permissions you list don't appear to be part of Android (8 or otherwise) and are likely after-market extensions in your phone's ROM.
  - hnburnsy 7y ago
    You don't see it under apps & notifications - - > data usage control?
    - grawprog 7y ago
      I have two options on android 9 on a Motorola g7 background data usage and unrestricted data usage. On allows or disallows background data usage, the other allows full access to data when data saver mode is on. When I go to show all permissions it shows me which apps have full network access but does not allow me the option to toggle it.
      - Someone1234 7y ago
        That's all I see too.
      - hnburnsy 7y ago
        I see from another comment this is from my phone manufacture one plus, thanks to them for that.
  - dingo_bat 7y ago
    Ditto on Galaxy S10.
steve19 7y ago
Early versions of android did have a network permission. It was not able to be revoked but at least you knew apps that had no reason to require network access, like early flashlight apps, were not exfiltrating data. The permission may still exist (it has been a long time since I last wrote an android app) but it is no longer user visible.
- AnssiH 7y ago
  It is still there and visible on both Play Store and Settings when you open the full permission list for an app. It is called "have full network access".
panpanna 7y ago
This would make things so much safer for everyone but Google has so far refused to do this. (Android DOES have a network permission, but at some point Google decided it should always be allowed)
- userbinator 7y ago
  but at some point Google decided it should always be allowed Not at all surprising, if you consider Google's motives; they both want to appear like they care about privacy and give you an illusion of control, but at the same time they are ultimately an ad company who profits from the lack thereof. A lot of the decisions they make about their products make a lot of sense from this perspective.
  - viraptor 7y ago
    That's not a good take for a few reasons: - apps can use other ad networks than Google, and blocking network access would bring them more profit (higher app cost / more push for in-app spend) - they can create separate categories for ad traffic and general network traffic - having ads as a system element and limiting network access would allow them to cut off other ad networks to some extent, bringing more profit (although that's opening the doors to more talks about monopoly)
- UncleMeat 7y ago
  Something like 75% of code in apps nowadays are part of SDKs. Even if an app itself doesn't need network, you need the network for ads and analytics.
  - shakna 7y ago
    So why not have a network interface that supplies a more fine-grained access, like CSP? (Except hopefully without the godawful syntax).
    - UncleMeat 7y ago
      Because people have also done science to demonstrate that fine grain permissions don't work for the huge majority of users.
kace91 7y ago
The problem is when an app finds a bullshit excuse to refuse to work unless they're provided all wanted permissions. even if they don't hard block their content that way, in practice, people are just going to flip the switch that makes the app work or make a dialog go away without reading. I just don't think pushing the choice of permissions to the end user is a good idea, not by itself. UX teaches us that people are lazy and will go through the easiest path.
- kevin_thibedeau 7y ago
  LineageOS has the solution to this problem. You can revoke fine grained capabilities while letting the app still think it has the permissions.
  - userbinator 7y ago
    Indeed. On the desktop, this is also known as a firewall. All apps practically think they have "network permissions", but if they actually try to make a connection, it will either time out or return errors.
    - bscphil 7y ago
      What operating systems have built in support for firewalling specific applications?
      - hirsin 7y ago
        Windows has for over a decade, I assume Linux does too.
      - viraptor 7y ago
        Depends what you mean by built-in. On Linux you can easily start something either in a namespace with no network, or filter out network calls by syscalls. Selinux/apparmor/tomoyo give you more fine grained control over what can be done over the network.
      - 7y ago

kerng 7y ago

Right on! Those are the very features that I'm missing! It seems super simple to provide that basic level of control to the end user. I also want shadow/fake address books and location information as a feature.

llarsson 7y ago

A cheap Huawei phone I had let me do that, right from its Settings! Now I have to use NetGuard for that (no root required). And this is how I have learned that Google's Calc app apparently wants network access. No thanks!

ignoramous 7y ago

This has been possible since Android 8, if not before. You could, per app, from the App Info page: 1. Disallow bg internet access. 2. Disallow fg internet access over wifi. 3. Disallow fg internet access over mobile network. I've been building an app that exposes privacy features like bouncing permissions when apps are in bg (remember AppOps?), firewalling apps by disallowing data usage, setting DNS over TLS to servers that blackhole ads and trackers, show log of network activity, kill bg processes and activities and so on. Hopefully, would be done in a month or so. You could do all of the above, today, but mostly, manually, by navigating through nested menus and what-not. Android 10 would make some parts of what I'm building obsolete, and that's a good thing.

deleted 7y ago
[deleted]
dessant 7y ago
Is it possible that some of the controls for these network permissions you list are not in AOSP, but in a ROM made by the manufacturer of your device? The ones I've seen had a setting only for restricting background data usage.
- ignoramous 7y ago
  I've exercised this setting in Xiaomi, Oppo phones (Realme, Vivo, One Plus included) [0]. Unsure if it is in AOSP, but a user reported that its present in their Pixel running 8.1 [0]? You could see if NoRoot Firewall (requires VPN) or Glasswire (may or may not require VPN) help you disallow internet access per-app. [0] https://old.reddit.com/r/oneplus/comments/79g0ue/til_oxygenos_has_a_firewall_to_block_4g_or_wifi/ https://old.reddit.com/r/oneplus/comments/79g0ue/til_oxygeno...
  - saagarjha 7y ago
    This might be a Chinese thing: iPhones sold there have an option to disable apps from connecting to WLAN but I haven't seen this on any other SKU.
    - deleted 7y ago
      [deleted]
HenryBemis 7y ago
Since I never trusted iOS setup that one cannot restrict WiFi access on apps I had a firewall on my (jailbroken iOS). Now on Android I do the same (not trust the OS or the Data/WiFi switches and again I use a firewall to block either Data or WiFi or both. I also do this for data usage, e.g. Spotify and my podcatcher use Wi-fi while email etc use both data and WiFi. Edit: in the same spirit I block all free apps that don't require network connectivity such as health/workout apps. I kill all ads, and keep my data within. Edit2: android firewall is called "NoRoot Firewall"
Someone1234 7y ago
I have a Pixel 3 with the latest retail release (Android 9/August 1, 2019). I cannot do any of the things you described for any apps via the App Info page. I have permissions sliders for Camera, Contacts, Location, Microphone, Phone, and Storage. None at all for internet access or any specific network. The permissions you list don't appear to be part of Android (8 or otherwise) and are likely after-market extensions in your phone's ROM.
- hnburnsy 7y ago
  You don't see it under apps & notifications - - > data usage control?
  - grawprog 7y ago
    I have two options on android 9 on a Motorola g7 background data usage and unrestricted data usage. On allows or disallows background data usage, the other allows full access to data when data saver mode is on. When I go to show all permissions it shows me which apps have full network access but does not allow me the option to toggle it.
    - Someone1234 7y ago
      That's all I see too.
    - hnburnsy 7y ago
      I see from another comment this is from my phone manufacture one plus, thanks to them for that.
- dingo_bat 7y ago
  Ditto on Galaxy S10.

steve19 7y ago

Early versions of android did have a network permission. It was not able to be revoked but at least you knew apps that had no reason to require network access, like early flashlight apps, were not exfiltrating data. The permission may still exist (it has been a long time since I last wrote an android app) but it is no longer user visible.

AnssiH 7y ago
It is still there and visible on both Play Store and Settings when you open the full permission list for an app. It is called "have full network access".

panpanna 7y ago

This would make things so much safer for everyone but Google has so far refused to do this. (Android DOES have a network permission, but at some point Google decided it should always be allowed)

userbinator 7y ago
but at some point Google decided it should always be allowed Not at all surprising, if you consider Google's motives; they both want to appear like they care about privacy and give you an illusion of control, but at the same time they are ultimately an ad company who profits from the lack thereof. A lot of the decisions they make about their products make a lot of sense from this perspective.
- viraptor 7y ago
  That's not a good take for a few reasons: - apps can use other ad networks than Google, and blocking network access would bring them more profit (higher app cost / more push for in-app spend) - they can create separate categories for ad traffic and general network traffic - having ads as a system element and limiting network access would allow them to cut off other ad networks to some extent, bringing more profit (although that's opening the doors to more talks about monopoly)
UncleMeat 7y ago
Something like 75% of code in apps nowadays are part of SDKs. Even if an app itself doesn't need network, you need the network for ads and analytics.
- shakna 7y ago
  So why not have a network interface that supplies a more fine-grained access, like CSP? (Except hopefully without the godawful syntax).
  - UncleMeat 7y ago
    Because people have also done science to demonstrate that fine grain permissions don't work for the huge majority of users.

kace91 7y ago

The problem is when an app finds a bullshit excuse to refuse to work unless they're provided all wanted permissions. even if they don't hard block their content that way, in practice, people are just going to flip the switch that makes the app work or make a dialog go away without reading. I just don't think pushing the choice of permissions to the end user is a good idea, not by itself. UX teaches us that people are lazy and will go through the easiest path.

kevin_thibedeau 7y ago
LineageOS has the solution to this problem. You can revoke fine grained capabilities while letting the app still think it has the permissions.
- userbinator 7y ago
  Indeed. On the desktop, this is also known as a firewall. All apps practically think they have "network permissions", but if they actually try to make a connection, it will either time out or return errors.
  - bscphil 7y ago
    What operating systems have built in support for firewalling specific applications?
    - hirsin 7y ago
      Windows has for over a decade, I assume Linux does too.
    - viraptor 7y ago
      Depends what you mean by built-in. On Linux you can easily start something either in a namespace with no network, or filter out network calls by syscalls. Selinux/apparmor/tomoyo give you more fine grained control over what can be done over the network.
    - 7y ago