4 ms·

Android's permission system would be great if it wasn't for the one fatal flaw: Some idiot decided to make it declarative instead of deductive. This is one of

by moe 15y ago

Android's permission system would be great if it wasn't for the one fatal flaw: Some idiot decided to make it declarative instead of deductive. This is one of these fundamental bugs where you can only wonder what they are smoking at google. Instead of automatically scanning the code for actual API calls ("Ah, trying to send SMS here") they require the developer to manually declare their desired permissions in a separate manifest-file. Unsurprisingly this has led to the current situation where every little "wallpaper clock" app demands every permission under the sun, and then some, without ever actually using them. Developers are just dumb and lazy like that, go figure... So, my point is, android-style permission granularity is not a problem at all. Just make sure "can read phonebook" translates to will actually read your phonebook (hopefully soon in iOS) instead of developer is probably incompetent (Android).

commandar 15y ago
This is true, but it's also true that it's very common to see reviews where users complain about excessive, unnecessary permissions. It's also very common to see developers explain in app descriptions why they're requesting certain permissions (often times the answer is that the system bundles certain functionality under a permission the user wouldn't expect). It's not perfect by any means, but the system does seem to be working reasonably well for what it is. It's certainly a step up from, say, desktop Windows' UAC implementation. EDIT: Come to think of it, the problem with UAC is more or less the opposite of your complaint about Android's permission system -- apps don't ask for permission unless they need them with UAC, but UAC doesn't do a very good job of communicating what the app needs permission to do.
- moe 15y ago
  but it's also true that it's very common to see reviews where users complain about excessive, unnecessary permissions That may be true, but it's not showing a big effect. Pick two apps randomly from the store and you'll probably be asked to grant all sorts of unrelated permissions both times... developers explain in app descriptions why they're requesting certain permissions Yes, that's another aspect worth fixing. The developer should be able to annotate each critical call with an explanation. Although I like the idea in the sibling comment even better; just raise a popup when the permission is actually used (for the first time). There will be some corner-cases but in 9/10 cases that should make it pretty obvious for the user.
xsmasher 15y ago
Better yet, have the OS ask for the user's permission when the call is made like iOS does for GPS and push notifications. Then you'll only bug the user if they use a feature that requires the call, instead of giving a list of permissions when the app is installed.
- skeletonjelly 15y ago
  LBE Privacy Guard does this for Android (requires root though) http://www.appbrain.com/app/lbe-privacy-guard/com.lbe.security.lite http://www.appbrain.com/app/lbe-privacy-guard/com.lbe.securi... Should be baked in IMO.

by moe 15y ago

commandar 15y ago

This is true, but it's also true that it's very common to see reviews where users complain about excessive, unnecessary permissions. It's also very common to see developers explain in app descriptions why they're requesting certain permissions (often times the answer is that the system bundles certain functionality under a permission the user wouldn't expect). It's not perfect by any means, but the system does seem to be working reasonably well for what it is. It's certainly a step up from, say, desktop Windows' UAC implementation. EDIT: Come to think of it, the problem with UAC is more or less the opposite of your complaint about Android's permission system -- apps don't ask for permission unless they need them with UAC, but UAC doesn't do a very good job of communicating what the app needs permission to do.

moe 15y ago
but it's also true that it's very common to see reviews where users complain about excessive, unnecessary permissions That may be true, but it's not showing a big effect. Pick two apps randomly from the store and you'll probably be asked to grant all sorts of unrelated permissions both times... developers explain in app descriptions why they're requesting certain permissions Yes, that's another aspect worth fixing. The developer should be able to annotate each critical call with an explanation. Although I like the idea in the sibling comment even better; just raise a popup when the permission is actually used (for the first time). There will be some corner-cases but in 9/10 cases that should make it pretty obvious for the user.

xsmasher 15y ago

Better yet, have the OS ask for the user's permission when the call is made like iOS does for GPS and push notifications. Then you'll only bug the user if they use a feature that requires the call, instead of giving a list of permissions when the app is installed.

skeletonjelly 15y ago
LBE Privacy Guard does this for Android (requires root though) http://www.appbrain.com/app/lbe-privacy-guard/com.lbe.security.lite http://www.appbrain.com/app/lbe-privacy-guard/com.lbe.securi... Should be baked in IMO.