3 ms·

IMO internet access (android.permission.INTERNET) needs to be a runtime permission. Ideally with the same kind of granularity as location — one time, while app

IMO internet access (android.permission.INTERNET) needs to be a runtime permission. Ideally with the same kind of granularity as location — one time, while app is in use, in the background (through settings). And give an app a brief window to access the internet after an FCM push, but FCM pushes are also a runtime permission. But Google being an advertising company would, of course, never ever do this.

kevincox 6y ago
IIRC part of the problem is that there are other leaks through the intent system. So the system is so broken that adding a permission for INTERNET would just be an illusion of safety.
- matkoniecz 6y ago
  And this way even when forced to put it behind permission, it will be meaningless. It is not acccidental that this part would be so hard to fix.
- grishka 6y ago
  What do you mean? If you don't have the INTERNET permission in your manifest, you won't be able to create network sockets. So this enforcement is already in place, it has always been. The only possibility I see of leaking internet access through the intent system is when an app that does have internet access would give content:// URIs with granted URI permissions to an app that does not, so it would indirectly and unknowingly download something from the internet through that app's content provider. I don't think it's possible to grant anything on an http(s) URI. For that matter, almost any permission can be "leaked" this way. You could even skip the intents and content providers and just do it with straight AIDL if you're so inclined. Android's permission system is pretty solid and almost impossible to work around.
  - kevincox 6y ago
    The point of removing the INTERNET permission as I see it is to prevent the app from sending out any information, allowing you to trust it with your sensitive information. However if the app can raise an intent that will cause another app to send out information of its choosing it has effectively broken that permission, even if it never created a socket. Sure, the app may have a hard time getting information back (although there are channels such as app updates at the very least) it isn't enough to trust an app with your passwords just because it doesn't have any permissions.
eythian 6y ago
This means that nearly every application will have a pop up which nearly every user will get so used to seeing that they'll almost always just press "allow" on, which will mean permission prompts become less useful and security gets worse.

kevincox 6y ago

IIRC part of the problem is that there are other leaks through the intent system. So the system is so broken that adding a permission for INTERNET would just be an illusion of safety.

matkoniecz 6y ago
And this way even when forced to put it behind permission, it will be meaningless. It is not acccidental that this part would be so hard to fix.
grishka 6y ago
What do you mean? If you don't have the INTERNET permission in your manifest, you won't be able to create network sockets. So this enforcement is already in place, it has always been. The only possibility I see of leaking internet access through the intent system is when an app that does have internet access would give content:// URIs with granted URI permissions to an app that does not, so it would indirectly and unknowingly download something from the internet through that app's content provider. I don't think it's possible to grant anything on an http(s) URI. For that matter, almost any permission can be "leaked" this way. You could even skip the intents and content providers and just do it with straight AIDL if you're so inclined. Android's permission system is pretty solid and almost impossible to work around.
- kevincox 6y ago
  The point of removing the INTERNET permission as I see it is to prevent the app from sending out any information, allowing you to trust it with your sensitive information. However if the app can raise an intent that will cause another app to send out information of its choosing it has effectively broken that permission, even if it never created a socket. Sure, the app may have a hard time getting information back (although there are channels such as app updates at the very least) it isn't enough to trust an app with your passwords just because it doesn't have any permissions.

eythian 6y ago

This means that nearly every application will have a pop up which nearly every user will get so used to seeing that they'll almost always just press "allow" on, which will mean permission prompts become less useful and security gets worse.