5 ms·

I think this is Apple's problem really. Path is just one of many apps that probably do this without asking you. Ideally the OS should prompt you if an app want

by nc 15y ago

I think this is Apple's problem really. Path is just one of many apps that probably do this without asking you. Ideally the OS should prompt you if an app wants access to your address book, just like it does for location.

ajross 15y ago
Android apps must explicitly request a READ_CONTACTS permission. But even there, no one actually reads those permissions lists, and apps routinely ask for far more than they need. User authorization is a very weak security mechanism in the consumer space.
- Terretta 15y ago
  Like FB apps, even legit Android apps ask for the moon, with no option to dole out granular permissions. "The Weather Channel" is a default icon suggesting a free download on the Kindle Fire. It asks for: Set the wallpaper Send SMS messages Write to external storage Access info about Wi-Fi networks Access coarse location Initiate a phone call without going through the Dialer user interface for the user to confirm the call being placed Write (but not read) calendar data Read calendar data Required to be able to access the camera device Open network sockets Access fine GPS location Access vibration feature Access info about networks Record audio I haven't installed it, so I have no idea why it should be able to silently dial out without my permission or send SMS messages. If legit apps are demanding all this, then a Chinese weather app dialing those toll numbers in the Caribbean could do the same.
  - derwiki 15y ago
    With FB apps, you can go into your App settings and revoke individual permissions that you don't want to give. They still have to be granted to auth the app, but at least you can clean it up very quickly and easily.
    - Terretta 15y ago
      Sure, but if they're doing their job, by the time you can navigate there, they've already pulled your current data.
    - eco 15y ago
      Where is this setting? This is the second time I've heard someone say you could do that but I cannot find any options like that. Settings just has Refresh interval and options to configure notifications.
  - mike-cardwell 15y ago
    FWIW, if you have a rooted Android phone, you can install an app called "LBE Privacy Guard". It lets you install apps which require permission to send SMS, make calls, read contacts, access the network and a bunch of other things, but then prompts you when an app tries to do any of these things and lets you block/allow it temporarily/permanently.
    - deleted 15y ago
      [deleted]
    - Karunamon 15y ago
      Thanks for the tip - I'm going to go install that now and probably do a writeup.
  - brador 15y ago
    Why does a weather channel app require recording audio?
    - iclelland 15y ago
      To allow them to monitor tornadoes in your area, obviously.
  - lurker17 15y ago
    CyanogenMod allows the user to remove specific permissions frmo specific apps. If more users used CyanogenMod, more app developers would become compatible.
    - aw3c2 15y ago
      From what I have seen you can only remove those permissions "late". Ie you have to black list permissions, you cannot deny them right away. From my understanding this would not protect me fully since apps could do their thing before I disabled it.
      - biafra 15y ago
        As I understand it: They can't. If you do not open them manually or restart you phone (if they have the permission RECEIVE_BOOT_COMPLETED) They are not executing. You can install them and revoke certain permissions before they are running for the first time.
        aw3c2 15y ago
        Nice! I also remember seeing that permissions were reset on reboot, but that might have been some other setup, not CM.
    - seltzered_ 15y ago
      I use cyanogenmod and didn't know about this, nor do I think I or most folks will ever remember to do such things.
- rahoulb 15y ago
  Asking upfront is also a problem. Asking on demand is much more annoying to the user, but also makes them think about what the app is asking for - as opposed to a list of permissions at install time, which are skimmed over and then forgotten.
- Timothee 15y ago
  And Path has a precedent around asking more permissions than necessary: https://skitch.com/timothee/g911q/skitched-20120207-135815 https://skitch.com/timothee/g911q/skitched-20120207-135815 For their Facebook Connect permissions, they ask for all the permissions… (that was true beginning of November, not sure they changed it since)
- huggyface 15y ago
  But even there, no one actually reads those permissions lists, and apps routinely ask for far more than they need. Lots of people do read those permission lists, and they are one of the most commonly referenced complaints in app reviews. A firestorm arose when an Angry Birds update inexplicably added the ability to send SMS'. Further it focuses a spotlight when an app does request a permission that seems out of place. Ideally when Google evaluates app for their "staff's picks" (the "optional curation") they consider threat surface area.

by nc 15y ago

ajross 15y ago

Android apps must explicitly request a READ_CONTACTS permission. But even there, no one actually reads those permissions lists, and apps routinely ask for far more than they need. User authorization is a very weak security mechanism in the consumer space.

Terretta 15y ago
Like FB apps, even legit Android apps ask for the moon, with no option to dole out granular permissions. "The Weather Channel" is a default icon suggesting a free download on the Kindle Fire. It asks for: Set the wallpaper Send SMS messages Write to external storage Access info about Wi-Fi networks Access coarse location Initiate a phone call without going through the Dialer user interface for the user to confirm the call being placed Write (but not read) calendar data Read calendar data Required to be able to access the camera device Open network sockets Access fine GPS location Access vibration feature Access info about networks Record audio I haven't installed it, so I have no idea why it should be able to silently dial out without my permission or send SMS messages. If legit apps are demanding all this, then a Chinese weather app dialing those toll numbers in the Caribbean could do the same.
- derwiki 15y ago
  With FB apps, you can go into your App settings and revoke individual permissions that you don't want to give. They still have to be granted to auth the app, but at least you can clean it up very quickly and easily.
  - Terretta 15y ago
    Sure, but if they're doing their job, by the time you can navigate there, they've already pulled your current data.
  - eco 15y ago
    Where is this setting? This is the second time I've heard someone say you could do that but I cannot find any options like that. Settings just has Refresh interval and options to configure notifications.
- mike-cardwell 15y ago
  FWIW, if you have a rooted Android phone, you can install an app called "LBE Privacy Guard". It lets you install apps which require permission to send SMS, make calls, read contacts, access the network and a bunch of other things, but then prompts you when an app tries to do any of these things and lets you block/allow it temporarily/permanently.
  - deleted 15y ago
    [deleted]
  - Karunamon 15y ago
    Thanks for the tip - I'm going to go install that now and probably do a writeup.
- brador 15y ago
  Why does a weather channel app require recording audio?
  - iclelland 15y ago
    To allow them to monitor tornadoes in your area, obviously.
- lurker17 15y ago
  CyanogenMod allows the user to remove specific permissions frmo specific apps. If more users used CyanogenMod, more app developers would become compatible.
  - aw3c2 15y ago
    From what I have seen you can only remove those permissions "late". Ie you have to black list permissions, you cannot deny them right away. From my understanding this would not protect me fully since apps could do their thing before I disabled it.
    - biafra 15y ago
      As I understand it: They can't. If you do not open them manually or restart you phone (if they have the permission RECEIVE_BOOT_COMPLETED) They are not executing. You can install them and revoke certain permissions before they are running for the first time.
      - aw3c2 15y ago
        Nice! I also remember seeing that permissions were reset on reboot, but that might have been some other setup, not CM.
  - seltzered_ 15y ago
    I use cyanogenmod and didn't know about this, nor do I think I or most folks will ever remember to do such things.
rahoulb 15y ago
Asking upfront is also a problem. Asking on demand is much more annoying to the user, but also makes them think about what the app is asking for - as opposed to a list of permissions at install time, which are skimmed over and then forgotten.
Timothee 15y ago
And Path has a precedent around asking more permissions than necessary: https://skitch.com/timothee/g911q/skitched-20120207-135815 https://skitch.com/timothee/g911q/skitched-20120207-135815 For their Facebook Connect permissions, they ask for all the permissions… (that was true beginning of November, not sure they changed it since)
huggyface 15y ago
But even there, no one actually reads those permissions lists, and apps routinely ask for far more than they need. Lots of people do read those permission lists, and they are one of the most commonly referenced complaints in app reviews. A firestorm arose when an Angry Birds update inexplicably added the ability to send SMS'. Further it focuses a spotlight when an app does request a permission that seems out of place. Ideally when Google evaluates app for their "staff's picks" (the "optional curation") they consider threat surface area.