5 ms·

While it is much less of a concern with runtime permissions that are optional.... yeah, I greatly dislike this too. In particular because not everything is a r

by Groxx 4y ago

While it is much less of a concern with runtime permissions that are optional.... yeah, I greatly dislike this too. In particular because not everything is a runtime permission. E.g. I like to know that [apk X] has no internet or file permissions at all - it rules out nearly all practical ways to leak your information. And google just keeps taking more and more steps to hide that information from me.

bscphil 4y ago
> E.g. I like to know that [apk X] has no internet As far as I know (please correct if this is wrong), there's no such thing as an app with no Internet permissions. All apps can access the Internet without permission, and only additional uses of the Internet (e.g. seeing your WiFi AP name) require special permission. AFAIK the "Internet" permission many apps requested was actually for this more advanced usage - just to hit a REST endpoint or something required no permission at all.
- daveoc64 4y ago
  The internet permission is separate, and without it an app can't connect to the network: https://developer.android.com/reference/android/Manifest.permission#INTERNET https://developer.android.com/reference/android/Manifest.per... It's so commonly requested though, that virtually every app does have it.
  - Groxx 4y ago
    (extremely) commonly requested, and granted implicitly for I-don't-know-how-long-but-it-is-a-long-time. But for quite a while you could still read the permissions list in the play store, and see if it used it. And adding the permission would still give you a warning on upgrade (outside the play store anyway). Both of those (I believe) are gone nowadays. It's obviously going to be requested by most, but its absence can be extremely relevant, e.g. https://play.google.com/store/apps/details?id=keepass2android.keepass2android_nonet https://play.google.com/store/apps/details?id=keepass2androi...
- mdp2021 4y ago
  > please correct if this is wrong It is wrong. Internet permission is made of INTERNET and ACCESS_NETWORK_STATE, which are "normal"-level permissions to be specified in the Manifest. Without them, no Internet. Correctly: there are plentiful applications that do not need it.
- toast0 4y ago
  Google play stopped showing the internet permission ages ago, but it exists.
chias 4y ago
My biggest pet peeve is optional runtime permissions that are not optional. I have a CO2 monitor that you read through an android app. It cost like $250. If you don't give it geolocation permission, it just says "this app needs geolocation permission" and shows you a button to go to your settings to enable it. Any time you disable geolocation, you get that message and button again. I have yet to find any geolocation functionality in the app. EDIT: Please see epukaza's comment below. There is a legitimate reason for this permission, which his comment explains.
- UkrainianJew 4y ago
  They obviously want to collect the "CO2 readings at location" data and sell it to the highest bidder. Why do they refuse to opt you out of being an unpaid drone generating $0.02 worth of data for them after you paid them $250? Because they can, since we don't have any laws forbidding it.
- wonderbore 4y ago
  The geolocation information is not for you, it’s just sent along the rest of your information.
- epukaza 4y ago
  The app needs the geolocation permission to access the bluetooth radio and scan for devices. Any company can can technically do geolocation using nothing but nearby bluetooth MAC addresses if they have location information for any other phone/device in bluetooth range.
  - chias 4y ago
    Ah, that would make sense. It is indeed a bluetooth connection and it scans for any nearby devices. Thank you for clarifying that, I appreciate it, and I feel a lot better about the app!
    - tlavoie 4y ago
      Can you tell if that's all it does? I don't know what all geolocation covers in Android terms, but it would certainly be a superset of just scanning for BlueTooth. I would be curious if it does any or all of: - Fetching GPS coordinates, which are typically to many decimal places. - Making API requests to external servers that you don't own. A tool like MobSF (https://mobsf.github.io https://mobsf.github.io) might be very enlightening to understand what a given app does, or at least can do. I've tinkered a bit with an iOS app in it, but not Android so far. Also, proxying your device through Burp Suite or ZAP could also be interesting to see what traffic occurs, especially if the developers weren't picky about valid TLS certificates.

by Groxx 4y ago

bscphil 4y ago

> E.g. I like to know that [apk X] has no internet As far as I know (please correct if this is wrong), there's no such thing as an app with no Internet permissions. All apps can access the Internet without permission, and only additional uses of the Internet (e.g. seeing your WiFi AP name) require special permission. AFAIK the "Internet" permission many apps requested was actually for this more advanced usage - just to hit a REST endpoint or something required no permission at all.

daveoc64 4y ago
The internet permission is separate, and without it an app can't connect to the network: https://developer.android.com/reference/android/Manifest.permission#INTERNET https://developer.android.com/reference/android/Manifest.per... It's so commonly requested though, that virtually every app does have it.
- Groxx 4y ago
  (extremely) commonly requested, and granted implicitly for I-don't-know-how-long-but-it-is-a-long-time. But for quite a while you could still read the permissions list in the play store, and see if it used it. And adding the permission would still give you a warning on upgrade (outside the play store anyway). Both of those (I believe) are gone nowadays. It's obviously going to be requested by most, but its absence can be extremely relevant, e.g. https://play.google.com/store/apps/details?id=keepass2android.keepass2android_nonet https://play.google.com/store/apps/details?id=keepass2androi...
mdp2021 4y ago
> please correct if this is wrong It is wrong. Internet permission is made of INTERNET and ACCESS_NETWORK_STATE, which are "normal"-level permissions to be specified in the Manifest. Without them, no Internet. Correctly: there are plentiful applications that do not need it.
toast0 4y ago
Google play stopped showing the internet permission ages ago, but it exists.

chias 4y ago

My biggest pet peeve is optional runtime permissions that are not optional. I have a CO2 monitor that you read through an android app. It cost like $250. If you don't give it geolocation permission, it just says "this app needs geolocation permission" and shows you a button to go to your settings to enable it. Any time you disable geolocation, you get that message and button again. I have yet to find any geolocation functionality in the app. EDIT: Please see epukaza's comment below. There is a legitimate reason for this permission, which his comment explains.

UkrainianJew 4y ago
They obviously want to collect the "CO2 readings at location" data and sell it to the highest bidder. Why do they refuse to opt you out of being an unpaid drone generating $0.02 worth of data for them after you paid them $250? Because they can, since we don't have any laws forbidding it.
wonderbore 4y ago
The geolocation information is not for you, it’s just sent along the rest of your information.
epukaza 4y ago
The app needs the geolocation permission to access the bluetooth radio and scan for devices. Any company can can technically do geolocation using nothing but nearby bluetooth MAC addresses if they have location information for any other phone/device in bluetooth range.
- chias 4y ago
  Ah, that would make sense. It is indeed a bluetooth connection and it scans for any nearby devices. Thank you for clarifying that, I appreciate it, and I feel a lot better about the app!
  - tlavoie 4y ago
    Can you tell if that's all it does? I don't know what all geolocation covers in Android terms, but it would certainly be a superset of just scanning for BlueTooth. I would be curious if it does any or all of: - Fetching GPS coordinates, which are typically to many decimal places. - Making API requests to external servers that you don't own. A tool like MobSF (https://mobsf.github.io https://mobsf.github.io) might be very enlightening to understand what a given app does, or at least can do. I've tinkered a bit with an iOS app in it, but not Android so far. Also, proxying your device through Burp Suite or ZAP could also be interesting to see what traffic occurs, especially if the developers weren't picky about valid TLS certificates.