6 ms·

Fine-grained permissions aren’t useful if an application is going to request access to everything anyway - and non-technical or non-privacy-conscious users will

Fine-grained permissions aren’t useful if an application is going to request access to everything anyway - and non-technical or non-privacy-conscious users will click-through any and all permission prompts so [they can see the dancing bunnies](https://blog.codinghorror.com/the-dancing-bunnies-problem/ https://blog.codinghorror.com/the-dancing-bunnies-problem/). In the case of very popular, aggressively-marketed, apps like TikTok and Facebook’s: the lack of easy side-loading or alternative app-stores (with looser auditing) means they’re forced to comply with Apple’s regs against unnecessary permission prompts, and this means they simply can’t take advantage of users’ ignorance (or overriding desire to see the dancing bunnies) to get them to grant unnecessary permissions.

p1necone 6y ago
At least in Android (not familiar with iOS) you can deny apps access to any and all permissions, the features just won't work. I.e. if you deny Snapchat access to the camera you can still browse the app, read messages etc - you just won't be able to take any photos.
- DaiPlusPlus 6y ago
  That’s not my point: I’m arguing that apps like TikTok and Facebook are big enough that they could convince non-technical users (who are either ignorant-of, or just don’t care about, app permissions and privacy) to switch to an unofficial app-store where they could list their app without it being denied approval by Apple or Google for unreasonable app permission prompts. ...but the fact that unofficial app-stores for unjailbroken iOS devices do not exist makes this impossible for now. It’s very easy to imagine a TV ad or movie trailer ad for a TikTok or Facebook app with the cheerfully-voiced narrator saying “Just visit the TikTok Android App Store” or “Just open the Facebook iOS App Store” - then when the app is installed and first-opened the app would use a single “grant everything” permission prompt - or if the OS doesn’t allow that it could bombard the user with many prompts all-at-once and if the user denies any of them then a curtly-worded new messagebox would say “you must grant these permissions to use our app” otherwise the app quits. There’s not much Apple or Google could do to stop this that those app developers couldn’t work-around. Apple’s iOS App Store rejections for privacy reasons is a human solution to a non-technical problem, as it’s well-established that technical solutions to non-technical problems are ineffectual. It can be argued this is possible on Android - which does allow for other app-stores - and I did wonder why this isn’t already happening with Android users - then I realised that probably most Android users have those horrible carrier and OEM locked-down devices that make it harder (if not impossible) to change system settings or add other app-stores.
  - LordDragonfang 6y ago
    >they could convince non-technical users to switch to an unofficial app-store They could, but they're absolutely not going to. Every barrier you put between and user and installing your app is a percentage of those installs that you're losing. Doubly so for "non technical" users, who can barely work the app store in the first place. No company of that size is going to lose that many downloads just to steal a few more downloads. >then I realised that probably most Android users have those horrible carrier and OEM locked-down devices that make it harder (if not impossible) to change system settings or add other app-stores. Stock android makes you jump through hoops to install third party apps, and for good reason. No, it's not because "OEM locked-down devices", the reason you don't see it on android is because it doesn't make business sense.
    - chipotle_coyote 6y ago
      This has been my feeling for years, and why I think it'd probably be in Apple's interest to let people sideload apps. They could still require them to be signed, but otherwise be hands-off. The vast majority of users wouldn't go through whatever hoops were necessary to set that up -- even if it's just the single hoop of flipping an "allow non-App Store apps" switch in Settings -- but making it possible to do that gets them out of a lot of the regulatory imbroglio they've been heading toward. (I also can't help but feel it's necessary in the long run if they're serious about the iPad in particular being a general purpose computing device rather than an application console.)
      - pjmlp 6y ago
        So that iOS developers can enjoy the rampant piracy and app repackaging that takes place on Android?
    - Nextgrid 6y ago
      When it comes to a mainstream app like Facebook or TikTok that already has network effects and a critical mass of users, people will put up with significant efforts to alleviate their fear of missing out, including sideloading the app.
- efreak 6y ago
  You can deny permissions to any runtime permissions beginning with apps built for Marshmallow. You cannot deny other permissions. Some apps will absolutely block you from using them unless the permissions are on (this is by design of the app, not an OS limitation). Internet is a permission that is required if your app expects to go online. You cannot turn this permission off in the OS. If you modify Android to allow changing this permission (usually via Xposed) or rebuild the app to remove it from the manifest, many apps will actually crash when they try to go online; this is part of the reason why people use a firewall even on devices with Xposed installed. My vague understanding is that this is how Android works when an app tried to do something it can't--it closes the app. IIRC there is an Xposed module that filters by the URL, but I'm guessing it fakes the network response (more complex than simply disabling permission), and it doesn't work with ndk. With Marshmallow, runtime permissions were introduced for a number of existing permissions, where it would prompt you the first time the app tried to access privileged data. If your app is older than Marshmallow (ie, written for lollipop or KitKat), disabling any of the enabled permissions is liable to crash the app as soon as it tries to use them. For the full list of permissions on Android, see https://gist.github.com/Arinerron/1bcaadc7b1cbeae77de0263f4e15156f https://gist.github.com/Arinerron/1bcaadc7b1cbeae77de0263f4e... (there's a few links in the comments to Android source code; they cause my phone browser to crash, though) Feel free to correct me if I'm wrong, or if this information is outdated; much of it was specific to Android 6 release.
- vczf 6y ago
  By and large this is true. However, the android Citibank mobile app refuses to do anything useful if you don't give it access to your entire file system upfront. I don't think Apple would allow that kind of permissions abuse, but apparently Google does.
  - DaiPlusPlus 6y ago
    > However, the android Citibank mobile app refuses to do anything useful if you don't give it access to your entire file system upfront. Considering Citi’s corporate culture, I’d attribute this to incompetence rather than malice or a desire to spy on users. I’ll bet they’re using a third-party anti-spyware library to examine the Android FS for keyloggers/etc to protect their users’ security. It’s well-intentioned, but still idiotic. This is the same Citibank that’s been engaged in an idiotic arms-race with Google about blocking password-safes on their online banking login page for the past 5+ years - while also allowing me to do phone-banking without any real authentication - and STILL haven’t given me an EMV Chip+PIN credit-card, while the EMV Chip+Sign card I do have from them DOES have NFC without a purchase limit... anyone could steal my wallet and “tap” a couple grand off it. Arggghhhhhh. The “banks who think they’re smarter about security than platform vendors” trope is getting real old.
    - callalex 6y ago
      No, it’s because they like laundering money and the profit that brings, and hate any feature that might prove their wrongdoing empirically. https://www.reuters.com/article/us-citigroup-fine-idUSKBN1ET25A https://www.reuters.com/article/us-citigroup-fine-idUSKBN1ET...
      - DaiPlusPlus 6y ago
        Oh, of course - I understand most (if not all?) major banks have serious ethics issues from the top-down - but money-laundering is a business-objective and is distinct and separate from online banking security. The $70m fine (a joke to a multi-billion-dollar company) is insignificant to the potential damages from a class-action lawsuit from a wide-ranging vulnerability in their online banking platform - hence their focus and over-engineering on their online banking security - while the risks from credit-card abuse and individual identity-theft are much more limited in scope - and are a known-quantity.
- AnonC 6y ago
  That model was pioneered by Apple in iOS long before Android started taking it up with Android 6 (runtime permissions instead of collective install time permissions). Android took a few years to catch up and increase the range of runtime permissions, and apps on Android at that time would actually crash if some permission wasn't given. Even today, there are apps on Android that ask for needless permissions and refuse to continue unless the permissions or granted. That same app on iOS would provide more functionality (that's possible without having the permissions). There seems to be a very different mindset between Android developers compared to iOS developers.
jshen 6y ago
I don’t think this is the case. The way iOS tells users that an app is tracking location in the background has led to a large increase in users opting out in all the apps I’ve worked on. There are ways to be very effective at this as Apple has shown since that article was written over 15 years ago. Second, this effectiveness doesn’t require the walled garden and forcing apps to pay 30% of revenue to Apple.
- katbyte 6y ago
  Sounds like it’s working then? If an app asks me for location I personally go wtf no why do you need to know and most apps honestly don’t. I stick with apple for such a reason
  - luckylion 6y ago
    The point was "it's an OS feature, not an Appstore feature, so Apple's Walled Garden approach has nothing to do with that feature, Apple's OS has". It's working. But not because of Apple's Appstore policies.
    - rahkiin 6y ago
      With sideloading apps could use private APIs that circumvent these policies maybe
      - Nullabillity 6y ago
        Then the sandbox is broken..?
        bzzzt 6y ago
        Defense in depth right? First layer: iOS sandbox, second layer: App Store.
        grupthink 6y ago
WA 6y ago
> Fine-grained permissions aren’t useful if an application is going to request access to everything anyway If you build it right, it is totally doable. Implement it like in Health so that the app just gets empty data and doesn’t really know if it has access or not. If the app doesn’t function properly with an empty data set, reject such an app through App Store guidelines.
- jmiserez 6y ago
  What the parent poster means is that the second step (enforcement through rejection) won't work anymore.
chinesempire 6y ago
This is not true. my Android phone warns me if an app is trying to use features that require permission while in background and asks me if I want to revoke the permissions, enable it only while the app is active or let it use it always. pretty easy to use and anyone can guess that the bus or car sharing app doesn't need to use GPS all the time When the controller is a "smart" app store, you know what they delete, but you don't know what they keep and why they do it. they chose for you and never ask you if you're okay with it or not, so basically it's not your phone, it's their phone.
ralfd 6y ago
If one clicks through, the original Microsoft blog post by Larry Ostermanns is even more intriguing: https://docs.microsoft.com/en-us/archive/blogs/larryosterman/beware-of-the-dancing-bunnies https://docs.microsoft.com/en-us/archive/blogs/larryosterman... > I saw a post the other day (I'm not sure where, otherwise I'd cite it) that proclaimed that a properly designed system didn't need any anti-virus or anti-spyware software. Forgive me, but this comment is about as intellegent as "I can see a worldwide market for 10 computers" or "no properly written program should require more than 128K of RAM" or "no properly designed computer should require a fan". The reason for this is buried in the subject of this post, it's what I (and others) like to call the "dancing bunnies" problem. > What's the dancing bunnies problem? It's a description of what happens when a user receives an email message that says "click here to see the dancing bunnies". The user wants to see the dancing bunnies, so they click there. It doesn't matter how much you try to disuade them, if they want to see the dancing bunnies, then by gum, they're going to see the dancing bunnies. It doesn't matter how many technical hurdles you put in their way, if they stop the user from seeing the dancing bunny, then they're going to go and see the dancing bunny. > There are lots of techniques for mitigating the dancing bunny problem. There's strict privilege separation - users don't have access to any locations that can harm them. You can prevent users from downloading programs. You can make the user invoke magic commands to make code executable (chmod +e dancingbunnies). You can force the user to input a password when they want to access resources. You can block programs at the firewall. You can turn off scripting. You can do lots, and lots of things. However, at the end of the day, the user still wants to see the dancing bunny, and they'll do whatever's necessary to bypass your carefully constructed barriers in order to see the bunny > We know that user's will do whatever's necessary. How do we know that? Well, because at least one virus (one of the Beagle derivatives) propogated via a password encrypted .zip file. In order to see the contents, the user had to open the zip file and type in the password that was contained in the email. Users were more than happy to do that, even after years of education, and dozens of technological hurdles. All because they wanted to see the dancing bunny. The reason for a platform needing anti-virus and anti-spyware software is that it forms a final line of defense against the dancing bunny problem - at their heart, anti-virus software is software that scans every executable before it's loaded and prevents it from running if it looks like it contain a virus. As long as the user can run code or scripts, then viruses will exist, and anti-virus software will need to exist to protect users from them. ————— This was written 2005, before the iPhone and iPad. One could argue that the whole AppStore/Gatekeeper/Notarization system itself is a big giant patronizing Anti-malware-Software by Apple or focus on the last sentence, that on iOS the user can’t run non-sandboxed scripts and code. But it is also the case were Apple again did “think different”. > I saw a post the other day that proclaimed that a properly designed system didn't need any anti-virus or anti-spyware software. Forgive me, but this comment is about as intellegent as "I can see a worldwide market for 10 computers" or "no properly written program should require more than 128K of RAM" or "no properly designed computer should require a fan". Ha!
cosmojg 6y ago
I wonder if location prompts would be more effective if, instead of asking "Allow 'Example App' to access your location while you are using the app?", they explicitly state "'Example App' would like to know precisely where you are. Would you like to share your exact location?". I feel like those adjectives, "precisely" and "exact", would go a long way toward encouraging people to put more thought into the decision. Similar wording could be used for other permissions, maybe in conjunction with a one-or-two-second timer on the buttons.
- jasonshaev 6y ago
  This is a neat idea. Also, many apps don't need your EXACT location, just something like a zip code for convenience. AFAIK there is no mechanism for an App to request permissions to get a "rough" idea of where you are as opposed to a precise location
  - mercer 6y ago
    The new iOS will have that feature though, IIRC.

p1necone 6y ago

At least in Android (not familiar with iOS) you can deny apps access to any and all permissions, the features just won't work. I.e. if you deny Snapchat access to the camera you can still browse the app, read messages etc - you just won't be able to take any photos.

DaiPlusPlus 6y ago
That’s not my point: I’m arguing that apps like TikTok and Facebook are big enough that they could convince non-technical users (who are either ignorant-of, or just don’t care about, app permissions and privacy) to switch to an unofficial app-store where they could list their app without it being denied approval by Apple or Google for unreasonable app permission prompts. ...but the fact that unofficial app-stores for unjailbroken iOS devices do not exist makes this impossible for now. It’s very easy to imagine a TV ad or movie trailer ad for a TikTok or Facebook app with the cheerfully-voiced narrator saying “Just visit the TikTok Android App Store” or “Just open the Facebook iOS App Store” - then when the app is installed and first-opened the app would use a single “grant everything” permission prompt - or if the OS doesn’t allow that it could bombard the user with many prompts all-at-once and if the user denies any of them then a curtly-worded new messagebox would say “you must grant these permissions to use our app” otherwise the app quits. There’s not much Apple or Google could do to stop this that those app developers couldn’t work-around. Apple’s iOS App Store rejections for privacy reasons is a human solution to a non-technical problem, as it’s well-established that technical solutions to non-technical problems are ineffectual. It can be argued this is possible on Android - which does allow for other app-stores - and I did wonder why this isn’t already happening with Android users - then I realised that probably most Android users have those horrible carrier and OEM locked-down devices that make it harder (if not impossible) to change system settings or add other app-stores.
- LordDragonfang 6y ago
  >they could convince non-technical users to switch to an unofficial app-store They could, but they're absolutely not going to. Every barrier you put between and user and installing your app is a percentage of those installs that you're losing. Doubly so for "non technical" users, who can barely work the app store in the first place. No company of that size is going to lose that many downloads just to steal a few more downloads. >then I realised that probably most Android users have those horrible carrier and OEM locked-down devices that make it harder (if not impossible) to change system settings or add other app-stores. Stock android makes you jump through hoops to install third party apps, and for good reason. No, it's not because "OEM locked-down devices", the reason you don't see it on android is because it doesn't make business sense.
  - chipotle_coyote 6y ago
    This has been my feeling for years, and why I think it'd probably be in Apple's interest to let people sideload apps. They could still require them to be signed, but otherwise be hands-off. The vast majority of users wouldn't go through whatever hoops were necessary to set that up -- even if it's just the single hoop of flipping an "allow non-App Store apps" switch in Settings -- but making it possible to do that gets them out of a lot of the regulatory imbroglio they've been heading toward. (I also can't help but feel it's necessary in the long run if they're serious about the iPad in particular being a general purpose computing device rather than an application console.)
    - pjmlp 6y ago
      So that iOS developers can enjoy the rampant piracy and app repackaging that takes place on Android?
  - Nextgrid 6y ago
    When it comes to a mainstream app like Facebook or TikTok that already has network effects and a critical mass of users, people will put up with significant efforts to alleviate their fear of missing out, including sideloading the app.
efreak 6y ago
You can deny permissions to any runtime permissions beginning with apps built for Marshmallow. You cannot deny other permissions. Some apps will absolutely block you from using them unless the permissions are on (this is by design of the app, not an OS limitation). Internet is a permission that is required if your app expects to go online. You cannot turn this permission off in the OS. If you modify Android to allow changing this permission (usually via Xposed) or rebuild the app to remove it from the manifest, many apps will actually crash when they try to go online; this is part of the reason why people use a firewall even on devices with Xposed installed. My vague understanding is that this is how Android works when an app tried to do something it can't--it closes the app. IIRC there is an Xposed module that filters by the URL, but I'm guessing it fakes the network response (more complex than simply disabling permission), and it doesn't work with ndk. With Marshmallow, runtime permissions were introduced for a number of existing permissions, where it would prompt you the first time the app tried to access privileged data. If your app is older than Marshmallow (ie, written for lollipop or KitKat), disabling any of the enabled permissions is liable to crash the app as soon as it tries to use them. For the full list of permissions on Android, see https://gist.github.com/Arinerron/1bcaadc7b1cbeae77de0263f4e15156f https://gist.github.com/Arinerron/1bcaadc7b1cbeae77de0263f4e... (there's a few links in the comments to Android source code; they cause my phone browser to crash, though) Feel free to correct me if I'm wrong, or if this information is outdated; much of it was specific to Android 6 release.
vczf 6y ago
By and large this is true. However, the android Citibank mobile app refuses to do anything useful if you don't give it access to your entire file system upfront. I don't think Apple would allow that kind of permissions abuse, but apparently Google does.
- DaiPlusPlus 6y ago
  > However, the android Citibank mobile app refuses to do anything useful if you don't give it access to your entire file system upfront. Considering Citi’s corporate culture, I’d attribute this to incompetence rather than malice or a desire to spy on users. I’ll bet they’re using a third-party anti-spyware library to examine the Android FS for keyloggers/etc to protect their users’ security. It’s well-intentioned, but still idiotic. This is the same Citibank that’s been engaged in an idiotic arms-race with Google about blocking password-safes on their online banking login page for the past 5+ years - while also allowing me to do phone-banking without any real authentication - and STILL haven’t given me an EMV Chip+PIN credit-card, while the EMV Chip+Sign card I do have from them DOES have NFC without a purchase limit... anyone could steal my wallet and “tap” a couple grand off it. Arggghhhhhh. The “banks who think they’re smarter about security than platform vendors” trope is getting real old.
  - callalex 6y ago
    No, it’s because they like laundering money and the profit that brings, and hate any feature that might prove their wrongdoing empirically. https://www.reuters.com/article/us-citigroup-fine-idUSKBN1ET25A https://www.reuters.com/article/us-citigroup-fine-idUSKBN1ET...
    - DaiPlusPlus 6y ago
      Oh, of course - I understand most (if not all?) major banks have serious ethics issues from the top-down - but money-laundering is a business-objective and is distinct and separate from online banking security. The $70m fine (a joke to a multi-billion-dollar company) is insignificant to the potential damages from a class-action lawsuit from a wide-ranging vulnerability in their online banking platform - hence their focus and over-engineering on their online banking security - while the risks from credit-card abuse and individual identity-theft are much more limited in scope - and are a known-quantity.
AnonC 6y ago
That model was pioneered by Apple in iOS long before Android started taking it up with Android 6 (runtime permissions instead of collective install time permissions). Android took a few years to catch up and increase the range of runtime permissions, and apps on Android at that time would actually crash if some permission wasn't given. Even today, there are apps on Android that ask for needless permissions and refuse to continue unless the permissions or granted. That same app on iOS would provide more functionality (that's possible without having the permissions). There seems to be a very different mindset between Android developers compared to iOS developers.

jshen 6y ago

I don’t think this is the case. The way iOS tells users that an app is tracking location in the background has led to a large increase in users opting out in all the apps I’ve worked on. There are ways to be very effective at this as Apple has shown since that article was written over 15 years ago. Second, this effectiveness doesn’t require the walled garden and forcing apps to pay 30% of revenue to Apple.

katbyte 6y ago
Sounds like it’s working then? If an app asks me for location I personally go wtf no why do you need to know and most apps honestly don’t. I stick with apple for such a reason
- luckylion 6y ago
  The point was "it's an OS feature, not an Appstore feature, so Apple's Walled Garden approach has nothing to do with that feature, Apple's OS has". It's working. But not because of Apple's Appstore policies.
  - rahkiin 6y ago
    With sideloading apps could use private APIs that circumvent these policies maybe
    - Nullabillity 6y ago
      Then the sandbox is broken..?
      - bzzzt 6y ago
        Defense in depth right? First layer: iOS sandbox, second layer: App Store.
        grupthink 6y ago

WA 6y ago

> Fine-grained permissions aren’t useful if an application is going to request access to everything anyway If you build it right, it is totally doable. Implement it like in Health so that the app just gets empty data and doesn’t really know if it has access or not. If the app doesn’t function properly with an empty data set, reject such an app through App Store guidelines.

jmiserez 6y ago
What the parent poster means is that the second step (enforcement through rejection) won't work anymore.

chinesempire 6y ago

This is not true. my Android phone warns me if an app is trying to use features that require permission while in background and asks me if I want to revoke the permissions, enable it only while the app is active or let it use it always. pretty easy to use and anyone can guess that the bus or car sharing app doesn't need to use GPS all the time When the controller is a "smart" app store, you know what they delete, but you don't know what they keep and why they do it. they chose for you and never ask you if you're okay with it or not, so basically it's not your phone, it's their phone.

ralfd 6y ago

If one clicks through, the original Microsoft blog post by Larry Ostermanns is even more intriguing: https://docs.microsoft.com/en-us/archive/blogs/larryosterman/beware-of-the-dancing-bunnies https://docs.microsoft.com/en-us/archive/blogs/larryosterman... > I saw a post the other day (I'm not sure where, otherwise I'd cite it) that proclaimed that a properly designed system didn't need any anti-virus or anti-spyware software. Forgive me, but this comment is about as intellegent as "I can see a worldwide market for 10 computers" or "no properly written program should require more than 128K of RAM" or "no properly designed computer should require a fan". The reason for this is buried in the subject of this post, it's what I (and others) like to call the "dancing bunnies" problem. > What's the dancing bunnies problem? It's a description of what happens when a user receives an email message that says "click here to see the dancing bunnies". The user wants to see the dancing bunnies, so they click there. It doesn't matter how much you try to disuade them, if they want to see the dancing bunnies, then by gum, they're going to see the dancing bunnies. It doesn't matter how many technical hurdles you put in their way, if they stop the user from seeing the dancing bunny, then they're going to go and see the dancing bunny. > There are lots of techniques for mitigating the dancing bunny problem. There's strict privilege separation - users don't have access to any locations that can harm them. You can prevent users from downloading programs. You can make the user invoke magic commands to make code executable (chmod +e dancingbunnies). You can force the user to input a password when they want to access resources. You can block programs at the firewall. You can turn off scripting. You can do lots, and lots of things. However, at the end of the day, the user still wants to see the dancing bunny, and they'll do whatever's necessary to bypass your carefully constructed barriers in order to see the bunny > We know that user's will do whatever's necessary. How do we know that? Well, because at least one virus (one of the Beagle derivatives) propogated via a password encrypted .zip file. In order to see the contents, the user had to open the zip file and type in the password that was contained in the email. Users were more than happy to do that, even after years of education, and dozens of technological hurdles. All because they wanted to see the dancing bunny. The reason for a platform needing anti-virus and anti-spyware software is that it forms a final line of defense against the dancing bunny problem - at their heart, anti-virus software is software that scans every executable before it's loaded and prevents it from running if it looks like it contain a virus. As long as the user can run code or scripts, then viruses will exist, and anti-virus software will need to exist to protect users from them. ————— This was written 2005, before the iPhone and iPad. One could argue that the whole AppStore/Gatekeeper/Notarization system itself is a big giant patronizing Anti-malware-Software by Apple or focus on the last sentence, that on iOS the user can’t run non-sandboxed scripts and code. But it is also the case were Apple again did “think different”. > I saw a post the other day that proclaimed that a properly designed system didn't need any anti-virus or anti-spyware software. Forgive me, but this comment is about as intellegent as "I can see a worldwide market for 10 computers" or "no properly written program should require more than 128K of RAM" or "no properly designed computer should require a fan". Ha!

cosmojg 6y ago

I wonder if location prompts would be more effective if, instead of asking "Allow 'Example App' to access your location while you are using the app?", they explicitly state "'Example App' would like to know precisely where you are. Would you like to share your exact location?". I feel like those adjectives, "precisely" and "exact", would go a long way toward encouraging people to put more thought into the decision. Similar wording could be used for other permissions, maybe in conjunction with a one-or-two-second timer on the buttons.

jasonshaev 6y ago
This is a neat idea. Also, many apps don't need your EXACT location, just something like a zip code for convenience. AFAIK there is no mechanism for an App to request permissions to get a "rough" idea of where you are as opposed to a precise location
- mercer 6y ago
  The new iOS will have that feature though, IIRC.