6 ms·

I don’t understand why apps need access to my photos at all. (with some very specific exceptions,) apps should only access a photo, which I first select using t

I don’t understand why apps need access to my photos at all. (with some very specific exceptions,) apps should only access a photo, which I first select using the system photo picker. There’s no need for apps to access the entire camera roll just so I can select one photo to use with that app. I know that that’s partially implemented with the limited photo access now, but it’s confusing from a UI perspective and I don’t understand why this isn’t the default. The only apps that need full access to my camera roll, are apps like Google Photos, Nextcloud or Immich. Everyone else can suck a lemon.

diggan 1y ago
> I don’t understand why apps need access to my photos at all. [...] There’s no need for apps to access the entire camera roll So apps like Google Photos or other alternatives to the Apple made Photos app just shouldn't exist at all, if I understand you correctly?
- b112 1y ago
  Did the parent edit their comment? Because your response seems to directly ignore multiple things they said.
  - diggan 1y ago
    Right now the comment says the same as when I wrote my comment: > I don’t understand why apps need access to my photos at all [...] There’s no need for apps to access the entire camera roll [...] The only apps that need full access to my camera roll, are apps like Google Photos, Nextcloud or Immich Which still make me ask the question: They think no apps should access all photos, there is never any need for that, and these app currently do that and they need that, so are they saying those apps shouldn't exist at all?
    - hdgvhicv 1y ago
      They literally say “The only apps that need full access to my camera roll, are apps like Google Photos” Obviously they don’t think the apps shouldn’t exist.
      - diggan 1y ago
        So again, how does that work when someone also feels like "There’s no need for apps to access the entire camera roll", am I having reading comprehension problems or is there something else going on here?
        amanaplanacanal 1y ago
        They listed what they thought should be the exceptions to the blanket statement.
- deleted 1y ago
  [deleted]
- ipaddr 1y ago
  Google photos stores your photos in the cloud or constantly tries to force you to backup everything to the cloud. So no it doesn't need permission to manage your local photos. Upload to Google and manage the photos on the cloud if you trust Google while increasing privacy for everyone else.
jamwil 1y ago
iOS already has exactly the experience you describe and it clearly urges you toward sharing only specific photos. The only feature request I have is to be able to scope app permissions to an album, since the current flow of selecting individual photos adds a lot of friction.
- privatelypublic 1y ago
  Unfortunately, no. It allows you to select which photos an app has access to, and I doubt anybody uses it more than once because of how many taps it takes to include a new photo. Unless I'm missing something.
  - deleted 1y ago
    [deleted]
  - throwaway1777 1y ago
    [dead]
  - jamwil 1y ago
    That’s exactly what OP asked for. To select which photos an app has access to using the system picker so they can’t see the whole camera roll.
    - AndroTux 1y ago
      No. I want to select photos the app has access to now. I don’t want to readjust my selection every time I want to upload a new photo. What I want is an upload button like in the browser. I click “add photo”, the system dialog opens, I select a photo, and then that gets sent to the app. Somehow, Apple managed to screw that up.
      - nar001 1y ago
        Could what you're saying also be basically, you see your whole photos, your whole gallery but the app itself only has access to the one picture you tap on? That way for the user it looks the same as if the app had access to your whole photos, but the app actually only sees the one you select?
turnsout 1y ago
Third party photo app developer here. You're right, it's crazy that it's basically all or nothing. Apple actually has a great API for selecting a single photo in a privacy-respecting way which does not give the developer access to the library at all. [0] But oddly, there is no corresponding API for safely saving or updating a photo in the library. So if your app involves editing a photo, you can't use this API. The only option you're left with is to request photo library access with that scary dialog. If the user selects the limited access option, it's not just confusing—it's a prohibitively bad user experience. If the user snaps a new photo and wants to edit it in my app, they have to tap a "Select more photos" button in my app, find the photo in the picker, close the picker, and then select the photo again in my UI. Personally, I evaluate full access on a developer-by-developer basis. Indie app developers are highly unlikely to nefariously scan your entire photo library, as they lack any incentive or motivation to do so. So I give apps like Darkroom or Halide full access. Meta, on the other hand, has every incentive to scan my whole library, and I assume they would. So even though it makes posting to Instagram much more painful, I selected limited photo library access for Instagram. Apple really needs to introduce a safe way for developers to access just the photos/videos users select, and then update those assets. [0]: https://developer.apple.com/documentation/photosui/photospicker https://developer.apple.com/documentation/photosui/photospic...
- blululu 1y ago
  This post really nails it. The fact that access to a user photo is an all or nothing game and the most basic operations require full access is a huge problem in Apple’s ecosystem. Web browsers are able to easily let a 3rd party upload a file without giving access to every single file on your computer. I’m sure there are some reasons why it is not so simple on iOS but it can be done and the current setup is really bad.
blululu 1y ago
To your point there are plenty of apps that explicitly operate on the photo reel so the api/permission is needed. Steelmanning the point: plenty of apps request photo permissions that shouldn’t need it. This is really an Apple problem though. They have their selective access option which is a patch on the problem inconvenient for the user. I have two apps that end up requesting photo permissions because basic things like saving or loading a photo require the full set of permissions. I would much rather Apple just have a widget that allows me to pipe that data in as a black box, since the pop up message is distracting and I only need the most basic capability. Instead they do some prop 65 warning where even the most basic and reasonable uses trip the warning and what’s app is allowed to scan your entire library with the same permission.
- kccqzy 1y ago
  > I have two apps that end up requesting photo permissions because basic things like saving or loading a photo require the full set of permissions. Absolutely not. Saving a photo does not need the full permissions. If an app does that, the developer is either ignorant or malicious. I see multiple apps that only have "Add Photos Only" permission including apps like Duolingo that. Similarly the use case of allowing the user to pick one photo doesn't require any permissions at all. Just use the system photo picker. I post reviews with photos regularly on Google Maps and the Google Maps app doesn't have any photo permissions.
  - halJordan 1y ago
    Glad to see someone on this site is reading Apple documentation from three years ago
- dgs_sgd 1y ago
  > plenty of apps request photo permissions that shouldn’t need it True, and this could maybe be solved by better app store review. Every app submitted to the app store is reviewed by a human for approval. The reviewers could apply more scrutiny to photo permissions and reject apps whose permissions aren't justified.
kccqzy 1y ago
The copy/paste feature is underused on iOS. These days if an app needs access to a photo, I try to determine whether the app uses the system photo picker (which doesn't need the app to have photos permission). If it doesn't I simply use the Photos app to copy a photo and then paste afterwards. A benefit is that you can strip location right from the Photos app. With third party apps like Metapho which can be invoked from the share sheet, you can even strip all metadata before copying. Some apps like WeChat somehow insist on building on their photo picker and they get the copy/paste treatment.
- const_cast 1y ago
  Apple should really had a "strip metadata" option directly in the photos picker widget. It would work well with their privacy marketing.
  - ghostpepper 1y ago
    FWIW I have a free app installed called iVerify that mostly just reminds me when a new iOS is released but recently I noticed they added a "Strip metadata from photo" feature to the sharing tray, so you can pipe a photo through it and then copy to another app.
    - 47thpresident 1y ago
      Is this only on iVerify EDR? I can’t seem to find it on the up-to-date basic version.
  - lights0123 1y ago
    It does, and location and captions are stripped by default using the system picker. It's the switches icon in the bottom left.
    - kccqzy 1y ago
      Doesn't strip all metadata, such as make/model, ISO, aperture etc.
serial_dev 1y ago
AFAIK Custom photo pickers access your pictures without (hopefully) doing anything nefarious with it. With that said, 95% of apps that do that should just not use custom file pickers.
signal11 1y ago
iOS has had a private photo picker for a few years now, where you can pick photos from within an app without giving access to all photos. WhatsApp doesn’t use it and Apple doesn’t hold them to account over it. So, um, yay? Apps like Signal do use it.
- sefrost 1y ago
  WhatsApp does appear to only have access to a subset of photos on my iPhone. The UX is a little clunky because you have to “add” a new photo which it can then access, but I prefer the privacy of it.
  - signal11 1y ago
    The subset of photos thing was a relatively clunky addition in iOS 14. iOS 17 introduced a much better picker but devs have to opt into using it for now. Signal[1] and a bunch of other apps do use the newer iOS 17 picker. [1] https://ibb.co/KpkfrDMZ https://ibb.co/KpkfrDMZ
- bee_rider 1y ago
  Do apps have the option to not use the photo picker? I thought from the app’s point of view, the photos that iOS shows it are all the photos on the filesystem.
- ks2048 1y ago
  If you set the access to “Limited Access”, then that’s what the App has. It’s not a decision for WhatsApp to make - it’s in iOS.
  - signal11 1y ago
    “Limited access” is an older iOS feature from 2020, and different from the “private access” photo picker introduced with iOS 17[1]. [1] https://developer.apple.com/videos/play/wwdc2023/10053/?time=183 https://developer.apple.com/videos/play/wwdc2023/10053/?time... Limited access isn’t great UX because it’s not reasonable for users to have to manage a list of photos for every app. The new one is much better, but unfortunately app devs have to opt into it for now.
m463 1y ago
I saw the canon camera app now needs full access to photos. It used to just need to add to it. this means - an external camera that wants to just add photos to the photo roll needs full access to all photos.
- fn-mote 1y ago
  By "needs" I take it that you mean "is programmed in such a way to require" and not that the permissions are required to do the job you are asking of it?
  - m463 1y ago
    ios allows the following permissions for your phone photo library: - no access - add photos only - can add photos to the library, but not access photos in the library - limited access- the app can only access the photos you select - full access - the app can access everything Canon used to allow limited access. Now it refuses to work without full access to your photo library. Honestly, it should allow any of those.
TallonRain 1y ago
They shouldn’t even need to access the camera roll at all in the vast majority of cases. The OS should simply pass photos and videos as an input to the app as an explicit user action; the camera roll itself should be a black box as far as the app is concerned.
BeFlatXIII 1y ago
Apple could easily fix this if they allowed apps to specify if they want the first square of the photo picker to be a camera icon (possibly even with a live preview background) or not. That's the #1 reason I see for apps using custom pickers. That or they're married to dogshit cross-platform toolkits.

diggan 1y ago

> I don’t understand why apps need access to my photos at all. [...] There’s no need for apps to access the entire camera roll So apps like Google Photos or other alternatives to the Apple made Photos app just shouldn't exist at all, if I understand you correctly?

b112 1y ago
Did the parent edit their comment? Because your response seems to directly ignore multiple things they said.
- diggan 1y ago
  Right now the comment says the same as when I wrote my comment: > I don’t understand why apps need access to my photos at all [...] There’s no need for apps to access the entire camera roll [...] The only apps that need full access to my camera roll, are apps like Google Photos, Nextcloud or Immich Which still make me ask the question: They think no apps should access all photos, there is never any need for that, and these app currently do that and they need that, so are they saying those apps shouldn't exist at all?
  - hdgvhicv 1y ago
    They literally say “The only apps that need full access to my camera roll, are apps like Google Photos” Obviously they don’t think the apps shouldn’t exist.
    - diggan 1y ago
      So again, how does that work when someone also feels like "There’s no need for apps to access the entire camera roll", am I having reading comprehension problems or is there something else going on here?
      - amanaplanacanal 1y ago
        They listed what they thought should be the exceptions to the blanket statement.
deleted 1y ago
[deleted]
ipaddr 1y ago
Google photos stores your photos in the cloud or constantly tries to force you to backup everything to the cloud. So no it doesn't need permission to manage your local photos. Upload to Google and manage the photos on the cloud if you trust Google while increasing privacy for everyone else.

jamwil 1y ago

iOS already has exactly the experience you describe and it clearly urges you toward sharing only specific photos. The only feature request I have is to be able to scope app permissions to an album, since the current flow of selecting individual photos adds a lot of friction.

privatelypublic 1y ago
Unfortunately, no. It allows you to select which photos an app has access to, and I doubt anybody uses it more than once because of how many taps it takes to include a new photo. Unless I'm missing something.
- deleted 1y ago
  [deleted]
- throwaway1777 1y ago
  [dead]
- jamwil 1y ago
  That’s exactly what OP asked for. To select which photos an app has access to using the system picker so they can’t see the whole camera roll.
  - AndroTux 1y ago
    No. I want to select photos the app has access to now. I don’t want to readjust my selection every time I want to upload a new photo. What I want is an upload button like in the browser. I click “add photo”, the system dialog opens, I select a photo, and then that gets sent to the app. Somehow, Apple managed to screw that up.
    - nar001 1y ago
      Could what you're saying also be basically, you see your whole photos, your whole gallery but the app itself only has access to the one picture you tap on? That way for the user it looks the same as if the app had access to your whole photos, but the app actually only sees the one you select?

turnsout 1y ago

Third party photo app developer here. You're right, it's crazy that it's basically all or nothing. Apple actually has a great API for selecting a single photo in a privacy-respecting way which does not give the developer access to the library at all. [0] But oddly, there is no corresponding API for safely saving or updating a photo in the library. So if your app involves editing a photo, you can't use this API. The only option you're left with is to request photo library access with that scary dialog. If the user selects the limited access option, it's not just confusing—it's a prohibitively bad user experience. If the user snaps a new photo and wants to edit it in my app, they have to tap a "Select more photos" button in my app, find the photo in the picker, close the picker, and then select the photo again in my UI. Personally, I evaluate full access on a developer-by-developer basis. Indie app developers are highly unlikely to nefariously scan your entire photo library, as they lack any incentive or motivation to do so. So I give apps like Darkroom or Halide full access. Meta, on the other hand, has every incentive to scan my whole library, and I assume they would. So even though it makes posting to Instagram much more painful, I selected limited photo library access for Instagram. Apple really needs to introduce a safe way for developers to access just the photos/videos users select, and then update those assets. [0]: https://developer.apple.com/documentation/photosui/photospicker https://developer.apple.com/documentation/photosui/photospic...

blululu 1y ago
This post really nails it. The fact that access to a user photo is an all or nothing game and the most basic operations require full access is a huge problem in Apple’s ecosystem. Web browsers are able to easily let a 3rd party upload a file without giving access to every single file on your computer. I’m sure there are some reasons why it is not so simple on iOS but it can be done and the current setup is really bad.

blululu 1y ago

To your point there are plenty of apps that explicitly operate on the photo reel so the api/permission is needed. Steelmanning the point: plenty of apps request photo permissions that shouldn’t need it. This is really an Apple problem though. They have their selective access option which is a patch on the problem inconvenient for the user. I have two apps that end up requesting photo permissions because basic things like saving or loading a photo require the full set of permissions. I would much rather Apple just have a widget that allows me to pipe that data in as a black box, since the pop up message is distracting and I only need the most basic capability. Instead they do some prop 65 warning where even the most basic and reasonable uses trip the warning and what’s app is allowed to scan your entire library with the same permission.

kccqzy 1y ago
> I have two apps that end up requesting photo permissions because basic things like saving or loading a photo require the full set of permissions. Absolutely not. Saving a photo does not need the full permissions. If an app does that, the developer is either ignorant or malicious. I see multiple apps that only have "Add Photos Only" permission including apps like Duolingo that. Similarly the use case of allowing the user to pick one photo doesn't require any permissions at all. Just use the system photo picker. I post reviews with photos regularly on Google Maps and the Google Maps app doesn't have any photo permissions.
- halJordan 1y ago
  Glad to see someone on this site is reading Apple documentation from three years ago
dgs_sgd 1y ago
> plenty of apps request photo permissions that shouldn’t need it True, and this could maybe be solved by better app store review. Every app submitted to the app store is reviewed by a human for approval. The reviewers could apply more scrutiny to photo permissions and reject apps whose permissions aren't justified.

kccqzy 1y ago

The copy/paste feature is underused on iOS. These days if an app needs access to a photo, I try to determine whether the app uses the system photo picker (which doesn't need the app to have photos permission). If it doesn't I simply use the Photos app to copy a photo and then paste afterwards. A benefit is that you can strip location right from the Photos app. With third party apps like Metapho which can be invoked from the share sheet, you can even strip all metadata before copying. Some apps like WeChat somehow insist on building on their photo picker and they get the copy/paste treatment.

const_cast 1y ago
Apple should really had a "strip metadata" option directly in the photos picker widget. It would work well with their privacy marketing.
- ghostpepper 1y ago
  FWIW I have a free app installed called iVerify that mostly just reminds me when a new iOS is released but recently I noticed they added a "Strip metadata from photo" feature to the sharing tray, so you can pipe a photo through it and then copy to another app.
  - 47thpresident 1y ago
    Is this only on iVerify EDR? I can’t seem to find it on the up-to-date basic version.
- lights0123 1y ago
  It does, and location and captions are stripped by default using the system picker. It's the switches icon in the bottom left.
  - kccqzy 1y ago
    Doesn't strip all metadata, such as make/model, ISO, aperture etc.

serial_dev 1y ago

AFAIK Custom photo pickers access your pictures without (hopefully) doing anything nefarious with it. With that said, 95% of apps that do that should just not use custom file pickers.

signal11 1y ago

iOS has had a private photo picker for a few years now, where you can pick photos from within an app without giving access to all photos. WhatsApp doesn’t use it and Apple doesn’t hold them to account over it. So, um, yay? Apps like Signal do use it.

sefrost 1y ago
WhatsApp does appear to only have access to a subset of photos on my iPhone. The UX is a little clunky because you have to “add” a new photo which it can then access, but I prefer the privacy of it.
- signal11 1y ago
  The subset of photos thing was a relatively clunky addition in iOS 14. iOS 17 introduced a much better picker but devs have to opt into using it for now. Signal[1] and a bunch of other apps do use the newer iOS 17 picker. [1] https://ibb.co/KpkfrDMZ https://ibb.co/KpkfrDMZ
bee_rider 1y ago
Do apps have the option to not use the photo picker? I thought from the app’s point of view, the photos that iOS shows it are all the photos on the filesystem.
ks2048 1y ago
If you set the access to “Limited Access”, then that’s what the App has. It’s not a decision for WhatsApp to make - it’s in iOS.
- signal11 1y ago
  “Limited access” is an older iOS feature from 2020, and different from the “private access” photo picker introduced with iOS 17[1]. [1] https://developer.apple.com/videos/play/wwdc2023/10053/?time=183 https://developer.apple.com/videos/play/wwdc2023/10053/?time... Limited access isn’t great UX because it’s not reasonable for users to have to manage a list of photos for every app. The new one is much better, but unfortunately app devs have to opt into it for now.

m463 1y ago

I saw the canon camera app now needs full access to photos. It used to just need to add to it. this means - an external camera that wants to just add photos to the photo roll needs full access to all photos.

fn-mote 1y ago
By "needs" I take it that you mean "is programmed in such a way to require" and not that the permissions are required to do the job you are asking of it?
- m463 1y ago
  ios allows the following permissions for your phone photo library: - no access - add photos only - can add photos to the library, but not access photos in the library - limited access- the app can only access the photos you select - full access - the app can access everything Canon used to allow limited access. Now it refuses to work without full access to your photo library. Honestly, it should allow any of those.

TallonRain 1y ago

They shouldn’t even need to access the camera roll at all in the vast majority of cases. The OS should simply pass photos and videos as an input to the app as an explicit user action; the camera roll itself should be a black box as far as the app is concerned.

BeFlatXIII 1y ago

Apple could easily fix this if they allowed apps to specify if they want the first square of the photo picker to be a camera icon (possibly even with a live preview background) or not. That's the #1 reason I see for apps using custom pickers. That or they're married to dogshit cross-platform toolkits.