5 ms·

A website cannot silently read a phone number and list of nearby WiFi access points for geolocation, scan local drive for interesting files, show annoying notif

A website cannot silently read a phone number and list of nearby WiFi access points for geolocation, scan local drive for interesting files, show annoying notifications every hour to return user back to the app.

andybak 7y ago
Neither can an app without the relevant permissions. Which of those things can the official Reddit app do currently? If you're saying "the Reddit app will slowly change to do bad things" then say that and don't imply it already does those things.
- labawi 7y ago
  Let's not kid ourselves about the safety or comprehensiveness of android permissions, or people clicking without reading. To be clear, I'm not claiming it does those things, but are you claiming it does not? And will not or could not?
  - lathiat 7y ago
    Maybe you should try iOS :-) it’s quite different here honestly. I’m not saying there aren’t holes they’ve had to patch [like recently adding a popup for Bluetooth LE permissions] but they are pretty good at closing them.
    - luma 7y ago
      I don't see how the permissions requested here would be substantially different in IOS. This isn't a matter of the OS, both Android and IOS offer fine-grained controls that are accessible to the user. It's up to the application developer what they request and what they do with it. I think people are right not to trust Tencent with this kind of access.
      - JimDabell 7y ago
        > both Android and IOS offer fine-grained controls that are accessible to the user. iOS doesn't allow apps to read the user's phone number or scan local Wi-Fi access points. The only files sandboxed apps can read on iOS are ones created by the app, explicitly passed to the app, or made available by the user, which is also possible on the web. The only thing mentioned that has the slightest bit of merit is being able to spam push notifications, and this is something that a) requires the user to grant permission, b) is easily disabled by the user if it's annoying, and c) explicitly forbidden by Apple: > 4.5.3 Do not use Apple Services to spam, phish, or send unsolicited messages to customers, including Game Center, Push Notifications, etc. […] > 4.5.4 Push Notifications must not be required for the app to function, and should not be used for advertising, promotions, or direct marketing purposes or to send sensitive personal or confidential information. Abuse of these services may result in revocation of your privileges.
    - bla3 7y ago
      App permissions may be better than on Android, but browser choice just doesn't exist on iOS. So suggesting iOS to people who'd rather use the web page than the app seems a bit strange.
      - teh_infallible 7y ago
        Browser choice does exist on iOS. I use Brave.
        the8472 7y ago
        All browsers on iphones are reskinned webkits.
        samatman 7y ago
        Brave is reskinned Chromium everywhere else, and reskinned Webkit on iOS. People who use Brave use it for reasons other than access to a unique rendering engine. Many of those reasons apply to the iOS version as well. Not making a case for Apple's decision here. I'd be happy if Gecko were available on iOS; there's no way I'd burn my battery like that, but competition is good. But it's not as simple as "there's one browser on iOS" either, the rendering engine is just one part of what makes a browser unique and useful.
- clort 7y ago
  > Which of those things can the official Reddit app do currently? Looking at https://play.google.com/store/apps/details?id=com.reddit.frontpage&hl=en https://play.google.com/store/apps/details?id=com.reddit.fro..., scroll down and click the 'View Details' under Permissions. It shows that the app can read your contacts, network connections, approximate location, contents of your USB storage plus much more which would cover all of codedokode's points adequately I think? (I'm not sure of the annoying notifications, perhaps all apps can do that..) The list in full: This app has access to: Photos/Media/Files read the contents of your USB storage modify or delete the contents of your USB storage Location approximate location (network-based) Storage read the contents of your USB storage modify or delete the contents of your USB storage Microphone record audio Camera take pictures and videos Contacts find accounts on the device Device & app history read sensitive log data Identity add or remove accounts find accounts on the device Other receive data from Internet view network connections prevent device from sleeping run at startup read Google service configuration draw over other apps read sync settings full network access create accounts and set passwords use accounts on the device toggle sync on and off install shortcuts
  - JshWright 7y ago
    Many (though certainly not all) of those things require explicit permission from the user (particularly the storage, location, and camera related stuff).
    - thewhitetulip 7y ago
      When all an app needs to do is connect to a website and cache a few images why does it need microphone access? Also if it has 100s of dialogs popping up users get a fatigue. They tend to say yes to everything and that's how default Android permissions are
      - inerg 7y ago
        I don't have the app installed but I'm assuming you can record video in it to post on Reddit? If that's the case I can see why it requires access to the microphone. That's the only way I could look at justifying it.
- deleted 7y ago
  [deleted]
- dreamcompiler 7y ago
  Even if the user has fine-grained control over these things, the app can just refuse to run until they're granted. I don't know if the reddit app does so, but many do. This is why users need control over the internal API layer of their phones so they can feed spoofed data to apps.
  - JimDabell 7y ago
    > Even if the user has fine-grained control over these things, the app can just refuse to run until they're granted. I don't know if the reddit app does so, but many do. Perhaps this is the case on Android, but this is explicitly forbidden by Apple: > (iv) Access Apps must respect the user’s permission settings and not attempt to manipulate, trick, or force people to consent to unnecessary data access. For example, apps that include the ability to post photos to a social network must not also require microphone access before allowing the user to upload photos. Where possible, provide alternative solutions for users who don’t grant consent. For example, if a user declines to share Location, offer the ability to manually enter an address. https://developer.apple.com/app-store/review/guidelines/#data-collection-and-storage https://developer.apple.com/app-store/review/guidelines/#dat...

andybak 7y ago

Neither can an app without the relevant permissions. Which of those things can the official Reddit app do currently? If you're saying "the Reddit app will slowly change to do bad things" then say that and don't imply it already does those things.

labawi 7y ago
Let's not kid ourselves about the safety or comprehensiveness of android permissions, or people clicking without reading. To be clear, I'm not claiming it does those things, but are you claiming it does not? And will not or could not?
- lathiat 7y ago
  Maybe you should try iOS :-) it’s quite different here honestly. I’m not saying there aren’t holes they’ve had to patch [like recently adding a popup for Bluetooth LE permissions] but they are pretty good at closing them.
  - luma 7y ago
    I don't see how the permissions requested here would be substantially different in IOS. This isn't a matter of the OS, both Android and IOS offer fine-grained controls that are accessible to the user. It's up to the application developer what they request and what they do with it. I think people are right not to trust Tencent with this kind of access.
    - JimDabell 7y ago
      > both Android and IOS offer fine-grained controls that are accessible to the user. iOS doesn't allow apps to read the user's phone number or scan local Wi-Fi access points. The only files sandboxed apps can read on iOS are ones created by the app, explicitly passed to the app, or made available by the user, which is also possible on the web. The only thing mentioned that has the slightest bit of merit is being able to spam push notifications, and this is something that a) requires the user to grant permission, b) is easily disabled by the user if it's annoying, and c) explicitly forbidden by Apple: > 4.5.3 Do not use Apple Services to spam, phish, or send unsolicited messages to customers, including Game Center, Push Notifications, etc. […] > 4.5.4 Push Notifications must not be required for the app to function, and should not be used for advertising, promotions, or direct marketing purposes or to send sensitive personal or confidential information. Abuse of these services may result in revocation of your privileges.
  - bla3 7y ago
    App permissions may be better than on Android, but browser choice just doesn't exist on iOS. So suggesting iOS to people who'd rather use the web page than the app seems a bit strange.
    - teh_infallible 7y ago
      Browser choice does exist on iOS. I use Brave.
      - the8472 7y ago
        All browsers on iphones are reskinned webkits.
        samatman 7y ago
        Brave is reskinned Chromium everywhere else, and reskinned Webkit on iOS. People who use Brave use it for reasons other than access to a unique rendering engine. Many of those reasons apply to the iOS version as well. Not making a case for Apple's decision here. I'd be happy if Gecko were available on iOS; there's no way I'd burn my battery like that, but competition is good. But it's not as simple as "there's one browser on iOS" either, the rendering engine is just one part of what makes a browser unique and useful.
clort 7y ago
> Which of those things can the official Reddit app do currently? Looking at https://play.google.com/store/apps/details?id=com.reddit.frontpage&hl=en https://play.google.com/store/apps/details?id=com.reddit.fro..., scroll down and click the 'View Details' under Permissions. It shows that the app can read your contacts, network connections, approximate location, contents of your USB storage plus much more which would cover all of codedokode's points adequately I think? (I'm not sure of the annoying notifications, perhaps all apps can do that..) The list in full: This app has access to: Photos/Media/Files read the contents of your USB storage modify or delete the contents of your USB storage Location approximate location (network-based) Storage read the contents of your USB storage modify or delete the contents of your USB storage Microphone record audio Camera take pictures and videos Contacts find accounts on the device Device & app history read sensitive log data Identity add or remove accounts find accounts on the device Other receive data from Internet view network connections prevent device from sleeping run at startup read Google service configuration draw over other apps read sync settings full network access create accounts and set passwords use accounts on the device toggle sync on and off install shortcuts
- JshWright 7y ago
  Many (though certainly not all) of those things require explicit permission from the user (particularly the storage, location, and camera related stuff).
  - thewhitetulip 7y ago
    When all an app needs to do is connect to a website and cache a few images why does it need microphone access? Also if it has 100s of dialogs popping up users get a fatigue. They tend to say yes to everything and that's how default Android permissions are
    - inerg 7y ago
      I don't have the app installed but I'm assuming you can record video in it to post on Reddit? If that's the case I can see why it requires access to the microphone. That's the only way I could look at justifying it.
deleted 7y ago
[deleted]
dreamcompiler 7y ago
Even if the user has fine-grained control over these things, the app can just refuse to run until they're granted. I don't know if the reddit app does so, but many do. This is why users need control over the internal API layer of their phones so they can feed spoofed data to apps.
- JimDabell 7y ago
  > Even if the user has fine-grained control over these things, the app can just refuse to run until they're granted. I don't know if the reddit app does so, but many do. Perhaps this is the case on Android, but this is explicitly forbidden by Apple: > (iv) Access Apps must respect the user’s permission settings and not attempt to manipulate, trick, or force people to consent to unnecessary data access. For example, apps that include the ability to post photos to a social network must not also require microphone access before allowing the user to upload photos. Where possible, provide alternative solutions for users who don’t grant consent. For example, if a user declines to share Location, offer the ability to manually enter an address. https://developer.apple.com/app-store/review/guidelines/#data-collection-and-storage https://developer.apple.com/app-store/review/guidelines/#dat...