3 ms·

The one thing people get upset about, but is necessary, is location. You can't get BLE access without providing location data, and this is very poorly described

The one thing people get upset about, but is necessary, is location. You can't get BLE access without providing location data, and this is very poorly described in the UI of android phones (I'm not sure about iOS). But having your phone want to call your contacts? That's ridiculous.

Spivak 5y ago
Yeah, Android really dropped the ball with "allow data that can potentially be used to derive your location" and "allow access to system APIs that give the app your rough/exact location." If the rule was applied consistently location access would be needed to access the internet since geoip exists.
kjaftaedi 5y ago
Developers mess this up as well.. you should only need to agree to location to pair your device the first time and the permission can be revoked after.. because the app should save the hardware id of the paired device. Many developers choose to have their app not function if this permission is removed, even though it is not needed. I've written a number of companies and gotten them to fix this, but Google is doing the biggest disservice by making it so confusing. I get the security aspect, and it's valid, but somehow they've made it impossibly confusing for both developers and end users.
- pedalpete 5y ago
  That's great advice. I thought everyone would be doing that. I'm almost positive we are, but I'll double check.
type0 5y ago
> But having your phone want to call your contacts? That's ridiculous. They probably want to sell their stuff to your friends, but how are they actually planning to do that? https://en.wikipedia.org/wiki/Direct_marketing https://en.wikipedia.org/wiki/Direct_marketing
swiley 5y ago
It's wanting access to a single serial port, that should have nothing to do with location. On Linux (on eg a pinephone or thinkpad) that would be adding the sandbox user to the dialout group (or to restrict it to a single port, creating a udev rule and adding the user to a special group.) Furthermore, having a closed app for this instead of some standard protocol (we have dozens) is completely ridiculous. This is a great example of two massive failures in the status quo for smart phone OSes and how they've been a regression in terms of privacy and security.

Spivak 5y ago

Yeah, Android really dropped the ball with "allow data that can potentially be used to derive your location" and "allow access to system APIs that give the app your rough/exact location." If the rule was applied consistently location access would be needed to access the internet since geoip exists.

kjaftaedi 5y ago

Developers mess this up as well.. you should only need to agree to location to pair your device the first time and the permission can be revoked after.. because the app should save the hardware id of the paired device. Many developers choose to have their app not function if this permission is removed, even though it is not needed. I've written a number of companies and gotten them to fix this, but Google is doing the biggest disservice by making it so confusing. I get the security aspect, and it's valid, but somehow they've made it impossibly confusing for both developers and end users.

pedalpete 5y ago
That's great advice. I thought everyone would be doing that. I'm almost positive we are, but I'll double check.

type0 5y ago

> But having your phone want to call your contacts? That's ridiculous. They probably want to sell their stuff to your friends, but how are they actually planning to do that? https://en.wikipedia.org/wiki/Direct_marketing https://en.wikipedia.org/wiki/Direct_marketing

swiley 5y ago

It's wanting access to a single serial port, that should have nothing to do with location. On Linux (on eg a pinephone or thinkpad) that would be adding the sandbox user to the dialout group (or to restrict it to a single port, creating a udev rule and adding the user to a special group.) Furthermore, having a closed app for this instead of some standard protocol (we have dozens) is completely ridiculous. This is a great example of two massive failures in the status quo for smart phone OSes and how they've been a regression in terms of privacy and security.