5 ms·
The Google apps will still probably work but will harass you till you can't take it anymore and just allow it access. Just now I updated to Android 10 and Googl
by hetspookjee 7y ago
The Google apps will still probably work but will harass you till you can't take it anymore and just allow it access. Just now I updated to Android 10 and Google play prompted me 3 seperate times with pretty serious warning that it needed acces to my SMS to work properly. I turned it down everytime and it still works, though I expect to receive more prompts. I knew there is a notification settings somewhere to turn these off.
I find it really troublesome that Google is allowed to blatantly lie to their consumers about the required permission by implying the app is utterly broken while it actually still works. Next year I'm going for an iPhone but as I can see it's not the promise Land yet.
- izacus 7y agoDisabling SMS permission for Play Services will silently break transparent SMS autofill API for any app on your phone, so the message is more than warranted. It actually breaks a core component of you phone. It's not a "blatant lie" if it actually breaks APIs.
- pvorb 7y agoWhat does this SMS autofill API do? I've never heard of it and wonder if it's needed.
- t0mas88 7y agoOne use is when you have to verify your phone number for something like WhatsApp, they send you a text and Google Play will detect receiving it and skip the step where you enter the code in the app. So it's a very minor inconvenience that you now have to type a few digits from an SMS instead of that happening automatically.
- cmroanirgo 7y agoBut if you think about it, WhatsApp needing your sms is a dark anti pattern anyway: the only time it needs sms is to uniquely identify you /provide you with an account. A username/pwd combo does that too. WhatsApp doesn't (or didn't, last time I used it a few years back) need sms access, let alone your phone number.
- tripzilch 7y agoThe alternative is not giving WhatsApp access to SMS, but receiving the SMS via normal means, and then entering the 5 digit code manually. My prediction: If people stop allowing this feature becomes even slightly popular, they're gonna use longer codes "for security".
- ohithereyou 7y agoWhatsApp is owned by Facebook, and Facebook must know all.
- thebean11 7y agoMy understanding was that WhatsApp doesn't gain access to SMS, the Google API gives WhatsApp the code only.
- izacus 7y agoThis "very minor" convenience also verifies sender signature to help avoid spoofing and phishing attacks and thus improves security. It was deemed important enough that Apple followed by implementing the API in iOS12.
- scambier 7y agoHow so? Does it do more than autofill?
- izacus 7y agoThe SMS needs to be signed on the server-side with the apps private key. Play Services verifies the signature before it passes the OTP key to the app. https://developers.google.com/identity/sms-retriever/verify https://developers.google.com/identity/sms-retriever/verify
- briandear 7y agoiOS has that and it doesn’t require some weird permission granted to a third party such as Google.
- izacus 7y agoDid you think for a second before you wrote your statement? How is Google a third party in their own operating system when implementing OS APIs?
- izacus 7y agoIt hangles SMS-based OTP authentication automatically - it grabs the OTP token and passes it to an app so the app doesn't have to require SMS access or ask user to retype the code. It also verifies the source of the SMS.
- hetspookjee 7y agoWell the thing that actually changes is that you now need to manually fill in the verification code. This creates an extra step in the process but nothing is broken like the prompt states. I find this a blatant lie. It would be more truthful if they actually told you the service you're missing out on by withdrawing this permission.
- tripzilch 7y ago> It would be more truthful if they actually told you the service you're missing out on by withdrawing this permission. Lack of this is one of those recurring struggles how you know the software isn't written any more for the benefit of the end user. There is no reason for this adversarial position (well, there is, but it has to do with you as a product, not a user).
- briandear 7y agoWhat is an SMS auto fill API and why would an Android user need it but not an iOS user?
- freepor 7y agoI like the iOS policy where if an app prompts for a permission 3 times and is denied then it doesn’t get to ask again.
- kmlx 7y agocan you still show that dialog after a button click or something?
- izacus 7y agoNo - and neither can you do it in Android. The second dialog already has a "Don't ask me again" tick which denies the permission permanently.
- BillinghamJ 7y agoAs far as I'm aware, the rule is that you get to ask once. If they decline, the only way to get it enabled is to direct the user to the settings app.