While showing which permissions are used is great, it's not a cure-all because they're all or nothing permissions. My background is in network security, I consi

While showing which permissions are used is great, it's not a cure-all because they're all or nothing permissions. My background is in network security, I consider myself a security-conscious person, but I am continually guilty of tapping INSTALL immediately without expanding the permissions list. The SMS permission in Android seems the most egregious to me. For example, an Android app you install requires SMS permission. However, in Android as it stands right now, the app does not need to notify a user when it sends an SMS - there's no requirement (nay, not even a widget to pop open and require the user to "Send" the way you see on other platforms like iOS--you've got to build this into your client yourself) to do this. So, you install a third party SMS client thinking you'll use it to send SMSes, but the app can send SMSes on its own, without you even seeing them. See also: http://www.cs.ncsu.edu/faculty/jiang/RogueSPPush/ http://www.cs.ncsu.edu/faculty/jiang/RogueSPPush/ Personally, while not perfect, I like Blackberry's model here (Cyanogenmod has implemented something similar) - the user can block out certain functions, knowing full well that the app will break - but can then decide to re-enable them if needed or once their trust level is raised.